---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Load Key Pairs and Certificates

# Load required key pairs and certificates for Code Signing {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Establish the relationship in a designated trusted instance using Code Signing. This
first step loads two cryptographic keys into the trusted environment to establish a trusted
source for updates to the production instance.

## Vorbereitungen

Roles required: security_admin and sn_kmf.cryptographic_manager

## Warum und wann dieser Vorgang ausgeführt wird

The first step in establishing the relationship is to establish the trust foundation in a designated trusted instance using Code Signing. To perform this task, you need the following.

* You must have two 4096-bit RSA public/private key pairs to load into Code Signing cryptographic modules:
  * One pair for the cm_code_signing cryptographic module
  * One pair for the cm_code_attest cryptographic module

  {#circle-trust-setup__ul_ubf_44y_mzb}

  For more information on these keys, see [Create Code Signing key pairs and certificates](https://servicenow-prod.fluidtopics.net/xBYv3sdIb7gsqj711SlqJA "Create two key pairs to signed certificates to establish trust between your protected and trusted instances.").  
  Wichtig:  
  These key pairs must be signed by a public certificate authority or signed by your organizations internal certificate authority. The certificate can't be self-signed.
* A Public Key Cryptography Standard #12 (.p12) file containing your leaf and intermediate certificates.
{#circle-trust-setup__ul_d2d_cxl_spb}

## Prozedur

1. Import your keys from the keystore.
   1. Navigate to AllKey ManagementCryptographic ModulesAll.
   2. Find and open the cryptographic module named <kbd class="ph userinput">cm_code_signing</kbd>.
   3. In the Crypto Specifications list, select the name of the crypto specification to open it.
   4. In the Import key from keystore screen, select Import key.
   {#circle-trust-setup__substeps_pmj_14s_dyb}
2. Repeat the first step to import the cryptographic module named <kbd class="ph userinput">cm_code_attest</kbd>.
3. In the Enter Keystore Password field, enter the challenge password you created when generating your RSA certificate.  
   Hinweis:  
   The challenge password that you created is referred to here as the keystore password. In other parts of the process, this may be referred to as either a import password or export password. In all cases, this password is the same challenge password that you created in the previous steps.
4. Select the Browse button next to Import Keystore/Certificate.
5. Select a Public Key Cryptography Standard #12 (.p12) file containing your distribution certificate (mentioned in the before you begin section at the top of this doc).
6. Select OK.  
   Wichtig:  
   If you're using your own internal certificate authority, you must upload the internal certificate authority's intermediate certificates using the process in steps 5--6.
   With a successful import of your key and certificate(s), a confirmation message is displayed.

   You can validate that the key and certificates are present on your instance on the X.509 Certificates \[sys_certificate\] table. These records have a type of
   Trust Store Cert.

   You can validate your key on the Cryptographic Modules \[sys_kmf_crypto_module\] table.

## Nächste Maßnahme

Export the certificate to production. See [Prepare Circle of Trust certificates](https://servicenow-prod.fluidtopics.net/ba6Os8vCBap75wcA4h9RjQ "Create an update set in the trusted environment to export the trusted certificate to the production environment.") for details.