3803453 - SOAP API certificate authentication fails after switching from basic to certificate-based authentication

• Switching from basic to certificate-based authentication for SOAP API requests results in failures.
• On CPI end, Error message observed: "org.apache.cxf.binding.soap.SoapFault: Rejected by policy".
• Requests succeed with basic authentication but fail when using a client certificate.
• Affected endpoints include wsapi/CPQAPI.asmx and wsapi/wssrv.asmx.

SAP CPQ

1. Open SOAP UI (or another SOAP client).
2. Target the SOAP API endpoint (for example, wsapi/wssrv.asmx).
3. Configure the call to use certificate-based authentication with a client certificate and run the request.
4. Observe that the call fails with an authentication/policy error (for example, SoapFault: Rejected by policy).
5. Reconfigure the same call to use basic authentication and run it again to confirm it succeeds.

Known issue and confirmed bug: certificate authentication for routes wsapi/CPQAPI.asmx and wsapi/WSSRV.asmx does not work.

Use the workaround by invoking the SOAP API through the mTLS route: replace the standard tenant base URL with the equivalent URL that includes the “-mtls” prefix (e.g. https://webcomqa2-devfl-mtls.cpq.dev.sap/), then call the same SOAP path (for example, …/wsapi/wssrv.asmx).

• refer to: System Certificates for Secure Communication
• refer to: Client Certificate Authentication - Cloud Integration configuration
• refer to: SOAP API WsSrv endpoint URL guidance

SOAP API, certificate authentication, mTLS, wsapi, wssrv.asmx, cpqapi.asmx, policy rejected, org.apache.cxf.binding.soap.SoapFault, client certificate, certificate-based authentication, basic authentication, authentication error, CPQ SOAP, mutual TLS, wsapi authentication , KBA , CEC-SAL-CPQ , Sales Cloud CPQ , Bug Filed