---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Root of Trust Settings

# Change your Root of Trust configuration {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Trust and use your own certificates instead of relying on ServiceNow build certificates (default) by changing to use your Root of Trust (ROT). ServiceNow components like script includes, business rules, etc., are signed at build time using a ServiceNow build time key (verification certificate is the ServiceNow build certificate).

## Changing the root of trust {#change-rot-overview__section_b41_xwd_pzb}

To change the Root of Trust for these records signatures, you must follow the change of Root of Trust process.

* Generate and migrate a new set of signatures for all provided components, using your provided certificate.
* Disable the Root of Trust property using a scheduled job.

{#change-rot-overview__ul_b54_ywd_pzb}Learn more about these steps in [Migrate signatures to use a customer certificate](https://servicenow-prod.fluidtopics.net/9QayvGG277wbgQAccqRTug "Run a signing job to migrate your signatures to a customer Root of Trust (ROT).") and [Disable ServiceNow Root of Trust](https://servicenow-prod.fluidtopics.net/_v3bOhlv4ghhYjIlXFC03g "Run a scheduled job on your trusted instance to disable Root of Trust.").

## Impact on the signature generation and verification process {#change-rot-overview__section_tc5_wwd_pzb}

By default, Code Signing build certificates are trusted during the signature verification process. After making this change, your
instance accepts signatures only from your own Code Signing certificate.
{#change-rot-overview__table_txw_zd2_pzb__entry__2}

| ROT property set to false (default) | ROT property set to true |
|-|-|
| * When verifying, signatures with build certificates are trusted. * When signing, if you don't provide keys, the instance signing key is used as a backup key. * The signature REST end point api/sn_kmf/signature/certificates returns ServiceNow Code Signing build certificates along with other certificates present on the instance. {#change-rot-overview__ul_xcl_d22_pzb} | * When verifying, signatures with build certificates aren't trusted. * When signing, if you don't provide keys, signing isn't performed. * The signature REST end point api/sn_kmf/signature/certificates excludes ServiceNow build certificates (San Diego, Vancouver PKI, W PKI). {#change-rot-overview__ul_mny_k22_pzb} |
[ ]

{#change-rot-overview__table_txw_zd2_pzb}

## Impact on your MID Server {#change-rot-overview__section_opl_212_pzb}

When the ROT property is set to false
:   If you choose to leave your ROT property at its default value (false), there's no impact on your MID Server.

When Code Signing is enabled and the ROT property is set to true
:
    * The isTrusted() API returns <kbd class="ph userinput">false</kbd> for signatures with a build certificate.
    * The isTrusted() API returns <kbd class="ph userinput">true</kbd> for signatures with your certificate.
    * The REST API call for certificates excludes build certificates.
    * You may see MID Server issues, such as <kbd class="ph userinput">signature validation failed</kbd> messages in the logs.
    {#change-rot-overview__ul_o1v_j12_pzb}
* **[Migrate signatures to use a customer certificate](https://servicenow-prod.fluidtopics.net/9QayvGG277wbgQAccqRTug)**   
  Run a signing job to migrate your signatures to a customer Root of Trust (ROT).
* **[Disable ServiceNow Root of Trust](https://servicenow-prod.fluidtopics.net/_v3bOhlv4ghhYjIlXFC03g)**   
  Run a scheduled job on your trusted instance to disable Root of Trust.