## 6.1.1.8.5.6.3  Parameters for Self-Managed X.509 Certificates
Use these parameters to provide your own certificates for a binding or service key to service instances of the SAP Authorization and Trust Management service (XSUAA).
## Prerequisites
- You've enabled the service instance to use X.509 secrets. For more information, see Application Security Descriptor Configuration Syntax [page 576].
- To use your own public key infrastructure (PKI), the certificates must be issued from one of the following certificate authorities (CA).
For more information, see Trusted Authorities for X.509 Certificates [page 2384].
## Parameters for Self-Managed Certificates
The create binding or create service key command expects a parameters.json in the following format.
```
{ "credential-type": "x509", "x509": { "certificate": "-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----", "ensure-uniqueness": false, "certificate-pinning": true, "hide-certificate": true } }
```
Parameters for Self-Managed Certificates
| Parameter         | Description                                                                                                                                                                                                                                                                                                                     |
|-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| credential-type   | Only required to use X.509 when X.509 isn't specified as default in the application security descriptor ( xs- security.json ). For more information, see Application Security Descriptor Configuration Syntax [page 576].                                                                                                       |
| x509              | In this parameter, you include the certificate and the options of uniqueness and pinning. This parameter is required.                                                                                                                                                                                                           |
| certificate       | Provide the certificate string in privacy-enhanced mail (PEM) format. This parameter is required.                                                                                                                                                                                                                               |
|                   |  Restriction You can only use each certificate once per service in- stance. The uniqueness of the certificate among all bindings and keys of a service instance is dependent on the value of certificate-pinning : • true The certificate hash must be unique. • false The combination of subject and issuer DNmust be unique. |
| ensure-uniqueness | Ensures that the certificate is unique among all following clone instances. The default value is false .                                                                                                                                                                                                                        |
|                   |  Note This parameter only applies to the broker plan of the service.                                                                                                                                                                                                                                                           |
| Parameter           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| certificate-pinning | Set to false for applications that are rarely updated or deployed. The incoming certificate's subject and issuer DNis compared to the subject and issuer of the stored certificate. If the values match and the certificate was issued on or after the stored issuer date, the authentication is accepted. Afterwards the incoming certificate's issuer date is stored for future authentication attempts. Exception: Matching certificates with a Valid from pa- rameter that is less than 10 minutes old are always ac- cepted. Set to true for blue and green deployments, where you deploy a new application or version of an application regu- larly and rotate the certificate in parallel. For this use case, you need a new certificate to use in the binding of the new application. |
| hide-certificate    | If this parameter is set to true (default is false ), the X.509 certificate is not returned in the binding or service key. This is useful to reduce the size of the environments when the Cloud Foundry environment limit of 130k has been reached. This parameter is optional.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
|                     |  Note This parameter works only with self-managed certifi- cates as otherwise, the public key would not be known to the user.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
## Related Information
Service Instance Secrets [page 2371]