Name: Transitioning Client Certificate CA from DigiCert to SAP Cloud Root CA – PET 2026
Uploaded: 2026-4-1
Duration: 594 s

Share feedback

<p>We are aware of intermittent issues in accessing the learning content</p>

We are aware of intermittent issues in accessing the learning content

Personalize your learning.

Why create an SAP account?

Enhance your learning experience

SAP Learning

Choose your subscription

Manage your subscription

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

This browser is not supported

Please try again later

Sorry, we encountered an error

Try again or reset results to continue browsing

We didn’t find what you’re looking for

To continue, please log in

Your session has timed out

Validate your skills and learning by completing the certification exam and gain a highly recognised accreditation.

Book your certification exam

Complete the assessment to validate your SAP PartnerEdge competency qualifications.

Ready to take your assessment?

Learn about the key features and essentials in the latest release to help you prepare for the Stay Certified assessment.

Prepare for assessment

Learn new skills you need at your own pace with our bite-sized lessons.

Prepare for certification

In your My Learning account you can view your certification and learn how to take your Stay Certified assessment.

Ready to take your Stay Certified assessment?

Explore {title} at SAP Learning. Find out more!

Assessment

Course Completion

Knowledge Badge

Overview

Support Resource

Certification Exam

Theoretical Exam

Schedule

External Course

Practical Exercise

Practical Test

External Hands-On

External Resource

Learning Journey

Learning Journey Assessment

Lesson

Live Session

Practice System

Quiz

Scenario Based Assessment

Course Assessment

Course

Stay Certified

Subscription

System Based Assessment

Test Out

Unit

Video

Video Playlist

Week

Want to remove this from your Learning List?

Your exclusive access to the SAP Learning Hub, event edition is ready. <link>Start learning now.</link>

Access activated

You can now register for free Live Sessions.

<div><div><div><div><div><div><div><div><div><div>SAP Business Suite Product Expert Training (PET) H1 2026 / Cross Topics / SAP Cloud ERP / SAP S/4HANA Cloud Public Edition / SAP Cloud ERP Security<br><br>This session provides information why and how to adjust certificate-based outbound communication in customer managed scenarios with SAP S/4HANA Cloud Public Edition, SAP IBP, and SAP Marketing Cloud as the source systems.<br><p>Ask your questions in our <a target="_blank" rel="nofollow noopener noreferrer" href="https://community.sap.com/t5/enterprise-resource-planning-q-a/qa-p/erp-questions">community</a> using the PET_Enablement tag under “Question User Tags.”</p><p>Here's the <a target="_blank" rel="nofollow noopener noreferrer" href="https://d.dam.sap.com/a/RKPAcJR/PET_Transitioning_Client_Certificate_CA_from_DigiCert_to_SAP_Root_CA.pdf?rc=10&inline=true&doi=SAP1291448">slide deck</a>.</p></div></div></div></div></div></div></div></div></div></div>

Transitioning Client Certificate CA from DigiCert to SAP Cloud Root CA – PET 2026

Hello everyone, my name is Florian Eller, and I am a product manager responsible for security features of SAP S/4HANA Cloud Public Edition. I have been working on security topics for more than 10 years now, and I want to present a topic that affects not only SAP S/4HANA Cloud Public Edition, but also SAP Integrated Business Planning and SAP Marketing Cloud. Today's session is about certificates used for outbound communication. Every SAP S/4HANA Cloud Public Edition, SAP IBP, or SAP Marketing Cloud system comes with an SAP -managed client certificate called Client Default. This certificate can be used for outbound calls and customer-managed communication scenarios. The source system, S4, IBP, or SMC calls out to another system, and the certificate is used for authentication of this call. If you have such an outbound integration using the client default certificate, you need to act. The reason for this is that after the next rotation of the client default certificate, the signing certificate authority of the certificate will be different. Additionally, the certificate subject will change. Evolving industry standards have led to this change of the certificate authority for the client default certificate. The idea behind this change is that a stricter distinction between client and server certificates is advisable. Now, if this change is not considered, then the potential of a connectivity disruption between source systems and target systems is real. Currently, the default client certificates for outbound communication are issued by DigiCert. In February 2026, SAP Cloud Root CA becomes the new Certificate Authority for newly issued client certificates. New systems will receive client certificates signed by SAP Cloud Root CA starting late March 2026. Existing systems will begin renewal with a staging certificate from late February 2026, fully transitioning during their next scheduled key rotation. Let me elaborate further. If you are a new customer, then starting in March 2026, new systems will receive client certificates signed by SAP Cloud Root CA. If you are an existing customer and your current client default certificate is valid until April 2026, the certificate authority change will happen in April for you. If your certificate expires in November 2026, you'll keep your DigiCert certificate until November and then switch to SAP Cloud Root CA. The picture in the lower right corner further describes this change. The current situation is displayed in the upper part describing the outbound communication using DigiCert. You will also notice updates to certificate subject names including additional organizational fields. As said before, you will also notice a change in the issuer. These changes will be present in all new client certificates issued during routine rotation. Misalignment of configurations in the target environment can lead to two categories of issues. First is CA trust failures. If your target environment does not trust the SAP Cloud Root CA, it will reject the new certificate. In these cases, the mutual TLS handshake fails and communication is blocked at the TLS layer. No HTTP. Error code is returned. Second is user system identity mapping errors. In the target environment, the certificate metadata that is the subject and issuer is mapped to the identity of a user or process. Consequently, if the mapping is not changed to use the new subject and issuer, authorization errors such as HTTP 403 or 401 will happen. Depending on the implementation of the target environment, TLS errors could also occur. In order to adjust to this change, customers now have to do the below two steps. First is to update CA Trust. Make sure the SAP Cloud Root CA is trusted by your target environment. You can download the root certificate from the SAP Trust Center. Second is to adjust user, system, identity mapping. Update your mapping logic to recognize the new certificate subject and issuer, ensuring the target environment properly identifies and authorizes the incoming connection. Let me now show you some of the steps you need to do in this system to handle the client default certificate rotation in your system landscape. Because we at SAP do not know your specific system landscape and the third-party systems it incorporates, there are certain limits to this demo. First, you have to go to the SAP Trust Center to get the new SAP Cloud Root CA. A link will be provided later. Please have a look at the screenshot on this slide. Please download the highlighted certificate and make it known to your environment. That means you have to configure your target system to trust the issuing CA of the client default certificate. This is done by uploading the issuer's root certificate, SAP Cloud Root CA certificate, into the trust store of the target system. I am now in one of our internal test systems. I have logged in as administrator and navigated to SAP Fiori app, Maintain Client Certificates. 30 days before the expiration, SAP issues a new default client certificate. You will be informed about it by email. Notice I have highlighted the client default certificate line. This is the old Default Client Certificate. You see that it is issued by DigiCert. The expiring certificate will be renamed to Client Default Expiring. So at some point you will see two entries instead of one. You also see that it has been changed at the beginning of this year and thus will change again once the validity will expire. As said before, when that happens, DigiCert as issuer will then change to SAP Cloud Root CA. From this new entry, you can take the new subject information, the issuer, as well as the organizational unit. As this is the certificate that authenticates your system against the target system, you will need to transfer this information over to the target system. Many target systems support certificate upload as a simple and robust mechanism for this. Use the download button in the actions column of the table to get your new client default certificate so you can upload it in the target system. If you click the table entry you can see the certificate information again plus more information like organizational unit and fingerprint. Note that the organizational unit is still empty in our example. The export button at the top right of the screen is another method to get a copy of the certificate. Another information you can derive from this screen is the specific communication systems using the client default certificate. Through this way, you can identify all third-party systems where this change must be made known. You need to switch the communication users for your outbound connections from the old client default certificate to the new one. When you now click on one of the relevant communication arrangements, you will navigate to the respective arrangement in the Communication Arrangements SAP Fiori app. There you can, if you haven't done so before, adjust the respective customer -managed outbound communication. As mentioned before, we do not have full visibility into customer system landscapes. Hence, any steps in customer-managed target systems cannot be shown. Typically, the steps to be done in the target system are Upload the downloaded certificate of SAP Cloud Root CA to the list of trusted CAs for client authentication. Upload the downloaded client default certificate to the user or system or connection configuration used in the integration. This slide lists further information to take care of this change. I especially would like to highlight the linked blog post in the middle of this slide where this topic is explained in more detail. In this blog post you can also find the direct link to the SAP Trust Center, the one I showed earlier to download SAP Cloud Root CA. I would also like to refer to SAP Note 3677763 listed here for more details. This note also refers to another Note 3119483 where the standard certificate renewal process is explained. A process we just briefly covered. There are more product expert sessions released. Stay tuned for more content. If you have feedback for us in our product expert training sessions, please let us know. For that, we have created the email address you see here. Having said that, I am at the end of my presentation. Thank you very much for your participation. I wish you a good day. Bye-bye.