Authenticate on-premise S4HANA to CPI via certificate

[joel_langoyan]

We are considering at least the S4HANA to CPI have authentication via certificate (if possible). I have read through Cloud Integration on CF – How to Setup Secure HTTP Inbound Connection with Client Certificates | SAP.... What I am sure if I understand correctly is, in the Configure Client Certificate in the Service Key in Cockpit section if S4HANA will be authenticated, am I to place the S4 certificate as shown below?

Also with regards to S4, is the one under SSL Client (standard) enough and correct for our goal?

If I'm getting a wrong understanding here, highly appreciate detailed steps to achieve this process. Thank you.

Regards,

Joel

[MartyMcCormick]

Hello

Yes, this would be the client certificate found in SSLC in your S4HANA system.

Thanks,
Marty

[joel_langoyan]

Hi Marty,

Thanks for your response. As per screenshot, validity days apply only to Certificate type. Does not mean there is no expiration for External certificate type?

Also, just curious to know if would there be authentication conflict if we have two service keys of different type? For example, we have external certificate type and one client/secret type.

Regards,

Joel

[MartyMcCormick]

Hi Joel

You are adding an external certificate so the validity would be that of the external cert (the client cert from S/4OP in this case).

You can create several service instances based on your requirements.

Thanks,
Marty

[joel_langoyan]

Hi Marty,

Just to make sure I have correct understanding. The blog mentions "Note that you can create multiple service keys for one service instance with different client certificates. But a client certificate can be assigned to one service instance only once.", so from what you mention and from the blog; my questions now are:

1. does it mean one instance can only have one type of service key? so cannot mixed different service key types in one instance?

2. does an instance can have multiple keys as long as they are same type?

Would just like clarify those as most blogs and documentation I reference does not mention of a two different authentication approach in one BTP or CPI tenant. Also I do not have access to the subaccount in BTP cockpit for our project.

Thanks,

Joel