This documentation references a blog post on the SAP forums (indicated in orange): https://blogs.sap.com/2006/09/29/setup-data-encryption-between-rfc-client-and-web-as-abap-with-snc/
Additional to the settings in the blog article, it may be necessary to set snc/gssapi_lib in the profile.
Preparations in the SAP system
To get started, we need to setup SNC on the SAP Server (Blog → Setup SNC on the ABAP Server)
Save the certificate for your SAP Server's SNC PSE (Blog → Export Server Certificate)
Preparations on the extractor server
To create our client PSE, from the extractor installation directory run the 'snc_create_pse.sh' script, providing your desired distinguished name and PSE password, e.g.:
./snc_create_pse.sh "CN=<YOUR_CHOSEN_CN>, OU=IT, O=CELONIS, C=DE" <your_chosen_password>
Now add the certificate from step 2 above by running the 'snc_add_pse_cert.sh', providing the same PSE password provided when generating it e.g.:
./snc_add_pse_cert.sh ~/IDES.crt <your_chosen_password>
As part of step 1 a client certificate is also generated named 'RFC.crt'. Import it into your SNC PSE on the SAP system (Blog → Import Client Certificate to Server PSE)
Start the extractor using ./start_with_snc.sh (if started from outside of the extractor installation directory then please provide it as a parameter to the script)
Use the distinguished name of the SAP Server's SNC PSE certificate as the SNC partner name in your Data Connection, e.g 'p:CN=IDES, OU=DEV, O=CELONIS, C=DE' (don't forget the p!)
Steps 2 - 3 can be repeated for each SAP Server you wish to connect to, afterwards just create separate Data Connections with the appropriate SNC partner names
Considerations when running as a Windows service
The provided 'install_with_snc.bat' will install a Windows service that bootstraps the extractor for SNC connections.
Open the Administrative Tools > Services window on your Windows server
Stop the service
Open the Properties > Log On dialog
Change the service user account to the user that ran 'snc_create_pse.bat'
Start the service
After allowing around 20-30 seconds for the service to start up, try the connection test