> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SAP S/4HANA with Client Certificate – StackOne Hub

> Link a SAP S/4HANA account in the StackOne Hub using Client Certificate. End-user guide to authorize the integration and start using SAP S/4HANA actions.

> [!WARNING]
>
> Administrator access to the SAP S/4HANA Cloud tenant is required to create Communication Users and Communication Arrangements, and you need a client certificate issued by a CA that SAP trusts.

## Find your API host

The API host is where StackOne sends requests.

**1. Work out the host**

For Cloud Public Edition, take your Fiori launchpad host and add `-api` after the system ID.

<ul>
  <li>Launchpad `https://my123456.s4hana.cloud.sap/ui` gives API host `my123456-api.s4hana.cloud.sap`</li>
  <li>For Private Edition or on-premise, use the host and port your Basis team exposes for OData, e.g. `s4.example.com:44300`</li>
</ul>

## Prepare the certificate

SAP only accepts client certificates signed by a CA on the SAP Global Trust List (SAP Note 2801396).

**1. Get a CA-signed certificate**

Obtain an X.509 client certificate and its private key from a CA on the SAP Global Trust List. You need both in PEM (Base64) format, with the private key unencrypted.

<ul>
  <li>Convert a binary DER `.cer` with `openssl x509 -inform der -in cert.cer -out cert.pem`</li>
  <li>Remove a key password with `openssl pkey -in key.pem -out key-plain.pem`</li>
  <li>Private Edition and on-premise: import the issuing CA into STRUST (SSL server PSE) and map the certificate to a user with CERTRULE; no Communication User or Arrangement is used</li>
</ul>

## Create the Communication User

The certificate identifies a Communication User.

**1. Upload the certificate**

Open **Maintain Communication Users**, click **New**, enter a User Name (e.g. `STACKONE_INTEGRATION`) and upload the client certificate under certificate-based authentication. Click **Create**.

## Create the Communication Arrangements

Each API is enabled by a Communication Arrangement.

**1. Create a Communication System**

Open **Communication Systems**, create a system for StackOne and add the Communication User under **Users for Inbound Communication** with authentication method **SSL Client Certificate**.

**2. Create the arrangements**

Open **Communication Arrangements** and create one arrangement per API, each using the Communication System above.

<ul>
  <li>`SAP_COM_0008` for Business Partner, Customer and Supplier</li>
  <li>`SAP_COM_0009` for Product</li>
  <li>`SAP_COM_0109` for Sales Order and Sales Order Simulation</li>
  <li>`SAP_COM_0120` for Billing Document</li>
  <li>`SAP_COM_0118` for Sales Quotation, `SAP_COM_0119` for Sales Contract</li>
  <li>`SAP_COM_0294` for Sales Pricing Condition Records, `SAP_COM_0134` for Customer Material</li>
  <li>`SAP_COM_0164` for Material Stock, `SAP_COM_0108` for Material Documents</li>
  <li>`SAP_COM_0374` for Warehouse, Storage Bins and Fixed Bins, `SAP_COM_0755` for Warehouse Stock, `SAP_COM_0353` for Warehouse Orders and Tasks</li>
  <li>`SAP_COM_0008` is needed for the connection test; for the others, create only the arrangements for the APIs you use, actions for other APIs return 403</li>
</ul>

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/connect/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.