Mutual TLS Authentication (mTLS)
Mutual TLS (mTLS) is an authentication protocol in which both the client and the server present certificates to verify each other's identity, providing two-way trust during a connection. On SAP BTP, developers use mTLS as a more secure alternative to client secrets for authenticating applications to services such as the SAP Authorization and Trust Management Service. It can also be configured at the infrastructure level — for example, via an mTLS gateway in SAP BTP, Kyma runtime — to enforce certificate-based mutual authentication between services. Developers retrieve OAuth access tokens using mTLS by presenting a client certificate instead of a client secret during the token request flow.
Docs explaining this concept
- Doc Audit Log Retrieval API Usage for Subaccounts in the Cloud Foundry Environment
- Doc Configure an mTLS Gateway
- Doc Enable mTLS Authentication to SAP Authorization and Trust Management Service for Your Application
- Doc Istio Service Mesh
- Doc Mutual TLS Authentication
- Doc Mutual TLS Authentication (mTLS) and Certificates Handling
- Doc Retrieving Access Tokens with Mutual Transport Layer Security (mTLS)
Prerequisites
- Concept TLS/SSL Configuration and mTLS
- Concept OAuth 2.0 Client Credentials Flow with mTLS The concept name provided is "undefined," and the supplied sources cover unrelated topics such as Communication System outbound user entities, mTLS token retrieval, OAuth client credentials, and destination configuration. There is insufficient information in the provided sources to write a grounded, accurate reference definition for an "undefined" concept.
- Concept Transport Layer Security (TLS) The provided sources do not contain sufficient information to write a grounded definition for an **undefined** concept. Source [S1] touches on frontend communication security between a customer browser and a system, but without a specific concept name or adequate supporting detail across the sources, no accurate and fully grounded definition can be produced. Please provide a valid concept name and relevant source snippets to generate a definition.
- Concept SAP HANA Certificate and PSE (Certificate Collection) Management The concept name provided is "undefined," and the available sources do not contain sufficient information to define a specific, identifiable SAP developer concept. The sources reference topics such as [downloading certificates](https://help.sap.com/docs/btp/sap-business-technology-platform/3645813291be47839e72ab08d8a31ac9?locale=en-US&state=PRODUCTION&version=Cloud), X.509 authentication, SAP HANA Cloud data virtualization, and SAP Analytics Cloud connections, but without a concrete concept name, no accurate and grounded definition can be produced.
- Concept Public Key Infrastructure (PKI) and Certificates Mutual TLS (mTLS) is an authentication mechanism in which both the client and the server present X.509 certificates to verify each other's identity during a TLS handshake. Developers use it on [SAP Business Technology Platform](https://help.sap.com/docs/btp/sap-business-technology-platform/b2746795de5543aca2eefa9de2424256?locale=en-US&state=PRODUCTION&version=Cloud) to establish secure, certificate-based trust between services and applications, going beyond standard one-way TLS where only the server is authenticated.