If logging in as an ECC user running against a BW system you need to have SSO configured from BOE to BW. That being said it it is a BEX or UNX connection you will configure STS wherein you'll create the pk12 and cert files. You will need to load the pk12 in the CMS repository via the SAP plugin in the CMC and the cert would be loaded to BW, you can ALSO load it to the ECC system, via the strustsso2 transaction.
-Josh