SAP’s managed cloud – Integration Suite / Cloud Integration (CPI) – doesn’t give you a server to log into, so there’s no PSE, no STRUST, no NWA Key Storage here. Certificate work happens entirely through browser-based tooling in the BTP cockpit, and it splits into two genuinely different jobs that are easy to conflate:
- Your own custom domain’s certificate – if you’ve set up a branded endpoint (e.g.
api.yourcompany.cominstead of the default SAP-provided tenant URL), this is the certificate that secures it. Managed through Custom Domain Manager. - Certificates in your tenant’s keystore – the trust store CPI uses when it calls out to other systems over HTTPS (on-premise, S/4HANA Cloud, third parties), plus any client certificates you use for inbound/outbound authentication. Managed through the Keystore (sometimes labelled Security Material) in the Integration Suite cockpit.
Which one you need depends on what you’re actually trying to secure – work out which of the two applies before you start, since the steps genuinely don’t overlap.
Same driver as the rest of this site: under the CA/Browser Forum’s SC-081 ruling, public certificate lifetimes are shrinking to 200 days from March 2026, 100 days from 2027, and 47 days from 2029. This guide covers a one-off setup for both cases; see our guide to automating CPI certificate renewal for the keystore side of that.
Setting up a custom domain with its own certificate
This uses SAP’s Custom Domain Manager, a BTP service. The exact cockpit screens vary by BTP environment and version, but the underlying flow is the same one SAP’s own tooling documents (via the neo command-line client, still referenced in SAP’s official custom-domain documentation even for newer setups):
- Custom domains need quota assigned to your subaccount first – this is a BTP entitlement, not something you configure yourself if it isn’t already there.
- Create an SSL host entry point for your domain (
neo create-ssl-host, or the equivalent step in Custom Domain Manager’s UI). - Generate a CSR – either through the same tooling (
neo generate-csr) or externally with OpenSSL if you’d rather manage the private key yourself.
Get the CSR signed
Submit it to your certificate authority the same way as any other system. If you haven’t sourced a certificate yet, you can browse and buy SSL certificates here directly.
Upload and bind the certificate
Upload the signed certificate chain (plus the private key, if it wasn’t generated in BTP) back through Custom Domain Manager, bind it to the SSL host you created, then map your custom domain to the specific Integration Suite applications you want it to cover (design-time and runtime endpoints are typically mapped separately). Once DNS is pointed at the SSL host via a CNAME, the custom domain starts serving over your certificate.
Adding a certificate to your tenant’s keystore
This is a separate job from the custom domain above – it’s for trusting (or authenticating as) other systems, not for securing your own branded URL. In the Integration Suite cockpit, open the Keystore (Operations view, or Security Material depending on your tenant type), and use Add to import a certificate. A Java keystore (.jks) is the expected format for a bundle – a single .crt can usually be converted first with a tool like KeyStore Explorer if that’s what you’ve been given. Uploaded certificates land in the tenant’s trust store, which CPI checks whenever it makes an outbound HTTPS call.
Verify it’s live
For a custom domain, load it in a browser and check the padlock, same as any other site. For a keystore certificate, the practical test is that the outbound or inbound connection you added it for actually authenticates successfully – there’s no visual “it’s working” indicator otherwise.
What’s next
Both of these are one-off setups today, but under SC-081’s shortening lifetimes, expect to be back here several times a year unless it’s automated. Our guide to automating CPI certificate renewal covers using the Security Content OData API to monitor expiry and push renewed certificates into the keystore automatically – note the custom domain piece still needs a manual renewal each cycle, as that guide explains. If something didn’t go to plan, our troubleshooting guide covers the errors we see most often here.