You’re dealing with client certificate authentication (mTLS) for outbound REST calls to SharePoint from an OutSystems 11 app. There are two parts to solve:

1. Getting the certificate into a format OutSystems / Windows can actually use
2. Making your REST call send that certificate on the TLS handshake

1. Prepare and install the certificate

OutSystems 11 (on Windows/IIS) relies on the Windows certificate store and the Platform’s SSL certificate configuration; it does not natively use raw .pem files.

a) Convert your .pem into a usable certificate

Typically you need a PFX (PKCS#12) that contains the private key plus the certificate chain.

If your admin has given you only a .pem, confirm whether it:

• contains the private key (-----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----)
• and the certificate (-----BEGIN CERTIFICATE-----)

If both are present, they can be converted to .pfx with OpenSSL (done by infra/admin, not in OutSystems). The result should be something like client-cert.pfx plus a password.

OutSystems requires the private key to be present, otherwise client authentication cannot be used at runtime.Installing client side certificates on self-managed environments

b) Install the certificate in the Windows machine store

On each front‑end server (self‑managed):

1. Open MMC (Start → mmc.exe)
2. File → Add/Remove Snap‑in → Certificates → Add
3. Choose Computer account → Local Computer
4. Go to Certificates (Local Computer) → Personal → Certificates
5. Right‑click Personal → All Tasks → Import…
6. Import the .pfx and provide the password
7. Ensure the certificate path (Root + intermediates) is correctly installed in:
   • Trusted Root Certification Authorities
   • Intermediate Certification Authorities as neededInstalling client side certificates on self-managed environments

c) Grant permissions on the private key

OutSystems app pools run under IIS worker identities. The certificate’s private key must be readable by those identities:

1. In MMC, under Personal → Certificates, right‑click your client cert → All Tasks → Manage private keys…
2. Add:
   • IIS_IUSRS
   • NETWORK SERVICE
3. Give them Read permissions (you don’t need Full Control).Installing client side certificates on self-managed environments

For OutSystems Cloud (PaaS): you don’t manage MMC yourself; you need to send the certificate to OutSystems support so they install it at infra level and configure outbound mTLS for you.SLL Certificates on REST Services (Consume)

2. Configure / reference the certificate in OutSystems

a) Service Center – SSL Certificates

Service Center’s Administration → Certificates / SSL Certificates is used to register certificates that the platform can use for secure integrations (including client‑side authentication).

You generally:

1. Upload / register the certificate (commonly the public part, in .cer or similar) in Service Center with a logical name.
2. Use that logical name in your integration logic (or in extensions / forge components) when attaching the certificate to the HTTP client.

However, OutSystems does not have a UI option in the REST API definition to “attach certificate X to this REST endpoint”. You must handle it at the HTTP request level programmatically.How to Configure Client Certificate for Outbound REST in O11

3. How to send the certificate with REST calls

Option 1 – OnBeforeRequest + extension / Forge component (recommended)

For consumed REST APIs in O11:

1. In Service Studio, open your consumed REST API that calls SharePoint.
2. Define an On Before Request advanced event for that REST API.
3. In the event, call an extension (C#) or a Forge component that can:
   • Find the certificate in the Windows store / platform store
   • Attach it to the outgoing HttpClient / request handler

There is an official pattern for SOAP, and similar logic applies to REST: use advanced extensibility to set up client certificate authentication.How to upload file by SOAP API with SSL Cert

For O11 REST HTTPs, you can use the Forge component HTTPS Consumer O11, which implements the client‑certificate handshake and lets you specify the certificate name / thumbprint and host.How to Configure Client Certificate for Outbound REST in O11

Internally, the C# code is similar to:

var handler = new HttpClientHandler();
handler.ClientCertificates.Add(clientCert);
var client = new HttpClient(handler);

This is exactly the approach mentioned in the older forum post: install cert in machine store, grant rights (Step B), and then attach it to the handler in code.SLL Certificates on REST Services (Consume)

Option 2 – Infrastructure‑level binding (Cloud / managed setups)

In some setups (especially OutSystems Cloud), the platform team may configure an outbound mTLS binding at the infra level (e.g., “when calling https://sharepoint.company.com, always use certificate X”).

When this is done, your REST API calls from OutSystems just use HTTPS normally; the TLS stack automatically picks the client certificate. In that case, you don’t need custom extensions; instead you coordinate with OutSystems support / infra team and provide them the .pfx/.pem so they configure the outbound connector.

4. How you should proceed for your SharePoint integration

Putting it all together for your scenario:

1. Confirm with your admin:

   • Does the .pem include the private key?
   • If not, ask for a .pfx + password containing the client cert and key.

2. Install the certificate:

   • On self‑managed: convert to .pfx; import into Local Computer → Personal; configure CA chain; grant IIS_IUSRS and NETWORK SERVICE read permissions.Installing client side certificates on self-managed environments
   • On OutSystems Cloud: open a support ticket and ask them to install it for client‑side authentication to SharePoint.

3. Register in Service Center (if applicable):

   • Under Administration → Certificates / SSL Certificates, add the certificate / give it a name.
   • This logical name can be used by extensions / Forge components that look up certificates.

4. Implement client‑certificate usage in your REST call:

   • Consume the SharePoint REST endpoint in Service Studio.
   • Configure an On Before Request event for that REST API.
   • Inside that event, call either:
     • A custom extension you build that attaches the client certificate to the HTTP request, or
     • A Forge component such as HTTPS Consumer O11 that already handles client certs and accepts the certificate name.How to Configure Client Certificate for Outbound REST in O11

This is the standard way to use a certificate “along with the API” in OutSystems 11: the certificate is handled by IIS / Windows and OutSystems platform, and you attach it to the HTTP client via advanced extensibility (OnBeforeRequest + extension), not via a simple dropdown in the REST configuration.

If you share whether your environment is OutSystems Cloud or self‑managed, I can outline more concrete steps tailored to that setup (e.g., exactly what to ask support vs what to do in MMC).