---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security
Release :
- australia
ft:locale :
- de-DE
ft:publication_title :
- Australia Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Create FIPS certificate for SAML
# Create FIPS certificate for SAML {#ariaid-title1}
* Freigeben Version: Australia
*
* Aktualisiert 12. März 2026
*
*  2 Minuten Lesedauer
Generate FIPS 140-2 compliant self-signed certificates and keystores for SAML authentication, specifically for signing SAML assertions and encrypting SAML messages.
## Vorbereitungen
Role required: sso_config_admin, business_rule_admin, script_include_admin
Do the following:
* Install Java on your machine and the key tool command-line tool accessible in your terminal (or "command prompt" if you are running it on a windows machine).
* Perform the following steps to create a key store using FIPS-approved cryptographic algorithms (such as RSA 2048+ or ECDSA with SHA-256/SHA-384) that meets federal security requirements for identity federation and single sign-on implementations.
{#create-fips-certificate-for-saml__ul_ij3_h2s_d3c}
## Prozedur
1. Download the [FIPS Provider Library](https://www.bouncycastle.org/download/bouncy-castle-java-fips/#latest).
Hinweis:
Use the latest version is bc-fips-2.1.0.jar. Make sure you use the most recent version.
2. Generate the FIPS-Compliant key store and certificate.
1. Run the following key tool command to generate a self-signed certificate and key store.
{#create-fips-certificate-for-saml__table_ozs_52s_d3c__entry__2}
| Running on Linux/macOS | Running on Windows: |
|-|-|
| keytool -genkeypair \ -providername BCFIPS \ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \ -providerpath >.jar \ -alias \ -keyalg RSA \ -keysize \ -keystore .bcfks \ -validity \ -storetype BCFKS \ -storepass | keytool -genkeypair ^ -providername BCFIPS ^ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider ^ -providerpath >.jar ^ -alias ^ -keyalg RSA ^ -keysize ^ -keystore .bcfks ^ -validity ^ -storetype BCFKS ^ -storepass |
[Tabelle : 1. Key tool command]
{#create-fips-certificate-for-saml__table_ozs_52s_d3c}
2. Replace placeholders (<...>) with appropriate values:
* `>.jar`: Path to `bc-fips-.jar`
* ``: Alias for the key pair
* ``: 2048 or 4096
* `.bcfks`: Desired file name for the key store
* ``: Expiry in days
* ``: Password for the key store
{#create-fips-certificate-for-saml__ul_mw4_z2s_d3c}
3. Follow the prompts to enter additional DN (Distinguished Name) details for the certificate.
Hinweis:
When you are prompted for a password for the key (alias), press the Enter or Return key to use the same password you used for the key store. Do not give a different password.
4. Securely store the key alias and key store password.
Provide these credentials while:
* Creating the sys_certificate record for this key store.
* Configuring the SAML Identity Provider to provide the signing key or encryption key alias and password.
{#create-fips-certificate-for-saml__ul_exc_jfs_d3c}
Hinweis:
The key password is same as the key store password specified during creation. Use the same password when configuring signing or encryption for the SAML Identity Provider.
{#create-fips-certificate-for-saml__substeps_d2d_q2s_d3c}
3. Extract the Certificate Chain.
{#create-fips-certificate-for-saml__table_lmx_yfs_d3c__entry__2}
| Running on Linux/macOS | Running on Windows: |
|-|-|
| keytool -exportcert \ -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \ -providerpath >.jar \ -storetype BCFKS \ -keystore .bcfks \ -storepass \ -alias \ -rfc \ -file .cer | keytool -exportcert ^ -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider ^ -providerpath >.jar ^ -storetype BCFKS ^ -keystore .bcfks ^ -storepass ^ -alias ^ -rfc ^ -file .cer |
[Tabelle : 2. Key tool command]
{#create-fips-certificate-for-saml__table_lmx_yfs_d3c}
Replace placeholders (<...>) with appropriate values:
* `>.jar`: Path to `bc-fips-.jar`
* `.bcfks`: Key store file name as given in previous step
* ``: Key store password as given in previous step
* ``: Key alias as given in previous step
* `.cer`: Desired file name for the extracted certificate in PEM format
{#create-fips-certificate-for-saml__ul_fvs_cgs_d3c}
4. Create a record on sys_certificate table.
1. Log in to ServiceNow AI Platform.
2. Navigate to AllMulti-Provider SSOAdministrationx509 Certificate.
3. Click New to create a record.
4. Select BCFKS key store as Type.
5. Attach the generated BCFKS key store file (<keystore_name>.bcfks).
6. Fill in other required fields, including the key store password provided during key store creation.
7. Click Validate Stores or Certificates related link to ensure the key store is valid.
8. Copy the sys_id of this record.
{#create-fips-certificate-for-saml__substeps_g4n_rgs_d3c}