TLS Mutual Authentication on Cloud Foundry

[former_member286482]

Is it possible to use client authentication based on X.509 certificates for services running on the Cloud Foundry environment of SAP Cloud Platform?

The setup is documented for the Neo environment (https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/0d7cf63b75a94f869895186a2d3... ). However for Cloud Foundry I could only find a documentation for setting this up with custom domains (https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/a85e3c414a4d4a9fb406215acb6...)

Is it possible to set up client authentication with one of the default domains (cfapps.eu10.hana.ondemand.com, cert.cfapps.eu10.hana.ondemand.com) ?

[former_member286482]

BUMP the post. I have same question.

[D_Olderdissen · Accepted solution]

This is an old thread but having tripped over this question recently. So here are my quick two cents:

Mutual TLS based authentication (transport encryption) with BTP (aka SAP CP) is possible. There are two ways how to do that

1. Your client has a cert that is signed by any of the trusted root certificates that SAP is using in the BTP load balancer.
2. Use a BTP custom domain - there you can import your own root CA and thus become more flexible when it comes to the client side certificate

And then there are things like message based encryption. Check out e.g. the CPI docs for more information on that.

Cheers,
Dirk