## 6.3.2.2.1.2  Configuring Client Certificate Authentication
When using the client certificate authentication method, the client application uses a client certificate to authenticate against the ABAP environment as corresponding communication user.
## Context
The client certificate can be provided by the application itself or by the SAP Destination service. The ABAP environment needs to trust the signing root certificate authority (CA). The list of trusted root certificate authorities can be found in SAP Note 2801396 .
## Procedure
1. Maintain the key store.
If the client application does not provide its own client certificate, then either upload a key store including the client certificate, the private key, and the certificate chain to the SAP Destination service, or generate one, for instance my-keystore.p12 . For more information, see Use Destination Certificates.
2. Get technical data of the own communication system.
Open the own communication system in the Communication Systems app in your ABAP environment system. To open your own communication system choose Own SAP Cloud System .
Denote the host name, for example, 1a354373-d200-46f6-9d5cdaab9a65d9b6.abap.eu10.hana.ondemand.com .
3. Create a destination.
Create a destination using the Destinations editor in the SAP BTP cockpit. For more information, see Using the Destination Editor in the Cockpit. Provide the following data:
| Field          | Input                                                                                                                                                 |
|----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| Name           | Enter the name of the destination that is used by the application, for example, my-client-certificate- destination .                                  |
| Type           | HTTP                                                                                                                                                  |
| URL            | Enter https://<hostname of the own communication system> , for example, https:// 1a354373-d200-46f6-9d5c- daab9a65d9b6.abap.eu10.hana.ondemand.co m . |
| Proxy Type     | Internet                                                                                                                                              |
| Authentication | ClientCertificateAuthentication                                                                                                                       |
| Field                           | Input                                                                                                                                                                          |
|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Use client provided certificate | Activate, if the client provides the client certificate. Other- wise, deactivate.                                                                                              |
| Key Store Location              | If the certificate is provided by the SAP Destinations service and not the client itself, then select the name of the corresponding key store, for instance my- keystore.p12 . |
| Key Store Password              | If the certificate is provided by the SAP Destinations serv- ice and not the client itself, then provide the password of the key store.                                        |
4. Create a communication user.
Create a communication user using the Maintain Communication Users app in your ABAP environment system. Enter the following data:
| Field       | Input                                                                                                                                                                   |
|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| User Name   | Provide a user name, for example, MY_CERT _USER .                                                                                                                       |
| Description | Provide a description.                                                                                                                                                  |
| Certificate | Upload the client certificate to the communication user. During runtime, the service will be processed by the com- munication user that is assigned to the certificate. |
5. Create a communication system.
Create a communication system using the Communication Systems app in your ABAP environment system. Enter the following data:
General Data
| Field                           | Input                                                        |
|---------------------------------|--------------------------------------------------------------|
| System ID                       | Provide a system ID, for example, MY_COMMUNICATION_PARTNER . |
| System Name                     | Provide a system name.                                       |
| Technical Data Field            | Input                                                        |
| General : Inbound Only          | Activate                                                     |
| Users for Inbound Communication |                                                              |
| Authentication Method           | User Name/Client ID                                          |
| SSL Client Certificate          | User name of the communication user, e.g. MY_CERT_USER       |
6. Create a communication arrangement.
Create a communication arrangement using the Communication Arrangements app in your ABAP environment system. Enter the following data:
| Field                                         | Input                                                                    |
|-----------------------------------------------|--------------------------------------------------------------------------|
| Scenario ID                                   | Select the scenario, for example, Z_MY_SCENARIO .                        |
| Arrangement Name                              | Provide a name, for example, MY_ARRANGEMENT .                            |
| Communication System                          | Select the communication system, for example, MY_COMMUNICATION_PARTNER . |
| Inbound Communication : User Name             | Select the communication user, for example, MY_CERT_USER .               |
| Inbound Communication : Authentication Method | SSL Client Certificate                                                   |
## Related Information
Maintain Communication Users [page 2708]
Communication Systems [page 2714] Communication Arrangements [page 2711]