...
Log into the Salesforce portal.
Navigate to Setup > Security Controls > Certificate and Key Management. The following page is displayed.
By default, you cannot view the Mutual Authentication Certificate section. In such case, you need to raise a request to the Salesforce Support team to enable this section.
Once this section is enabled, you need a CA signed certificate to upload in this section. See “Create CA signed certificate” for more information.
Once you have the CA signed certificate, click Upload Mutual Authentication Certificate.
Provide a label and name for your certificate.
Click Choose File to locate the certificate.
Click Save to save the upload.
Create a custom profile to enable the “Enforce SSL/TLS Mutual Authentication” user permission for an
API Onlyuser.
...