A screen-by-screen procedure to enable SAP ABAP X.509 client-certificate logon – CA trust, ICM client authentication, and certificate-to-user mapping.
A policy tells your teams what is required and a baseline sets the target value; this procedure shows them exactly how to configure X.509 client-certificate logon – transaction by transaction, screen by screen, using STRUST / SM30 (USREXTID). It turns the task into a controlled, repeatable method, from prerequisites and authorizations through execution, verification, and rollback.
Building that in-house means capturing the exact steps, the tier and transport behavior, and a safe backout, then keeping it consistent across every system. This procedure gives you a defensible, ready-to-run version today.
What this replaces
- A senior SAP Basis/security consultant documenting an equivalent, defensible procedure: typically several hours per task to research, write, and validate.
- Tribal knowledge and scattered notes: inconsistent, undocumented steps that fail audits and vary by administrator.
What you get
A configurable Microsoft Word procedure – fully editable, professionally formatted, and ready to execute:
- Complete method – prerequisites, screen-by-screen steps (STRUST / SM30 (USREXTID)), verification, and rollback for this task.
- Tier & transport aware – states where the work is performed and how changes move (or do not move) through the landscape.
- Framework alignment – mapped to NIST SP 800-53 (CM-2/CM-6), CIS, and the SAP security baseline, and to the governing SAP policy and baseline.
- Directly executable – bracketed placeholders (for example [ticketing system], [system tier]) so you can tailor it in minutes.