---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Manage Circle of Trust

# Import and install certificates for Circle of Trust {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Retrieve the update set in production to establish the trust relationship between the
two instances. The certificates that have been created to represent trust in the trusted
instance must be accepted into the protected instance.

## Vorbereitungen

Roles required: admin, security_admin

## Prozedur

1. In the protected instance, navigate to System Update SetsRetrieved Update Sets.
2. Select the Import Update Set from XML button on the bottom-left corner of the screen.  
3. Select Choose File and browse to select the XML file that you exported in [Prepare Circle of Trust certificates](https://servicenow-prod.fluidtopics.net/ba6Os8vCBap75wcA4h9RjQ "Create an update set in the trusted environment to export the trusted certificate to the production environment.").  
4. Select Upload.  
   The Code Signing update set is added to the Retrieved Update Sets table.  
   Hinweis:  
   If you don't see your update set, filter your list for records in the Loaded state, and sort the list by the Loaded field.
5. Open the update set record to verify that the Customer Updates table contains the following three records:  
   * Two KMF Signature Records
   * X.509 Certificate

   {#retrieve-updateset-prod__ul_arx_w5h_tpb}

6. Select Preview Update Set.
7. Select Commit Update Set.  
   The Retrieved Update Set State updates to Committed.
8. In the navigator, enter <kbd class="ph userinput">sn_kmf_record_signature.list</kbd> to open the KMF Signature Records list.
9. Locate the two KMF signature records.  
   These records are the most recently created records where the KMF Signature Purpose field has a value of <kbd class="ph userinput">Circle of Trust</kbd>. You may need to add the Created field to your list, or filter for records created on the current date.
10. In the navigator, enter <kbd class="ph userinput">sys_certificate.list</kbd> and open the record with a Short description value of code_signing_key and a Type value of <kbd class="ph userinput">Trust Store Cert</kbd>.
11. Select Install Trusted Code Signing cert.  
    The certificate type updates to Trusted CodeSigning Cert.  
    Wichtig:  
    Repeat these steps for your second certificate. Remember that there's a certificate for both the cm_code_attest and cm_code_signing cryptographic modules.

## Ergebnisse

The trust relationship is established between trusted and protected instances. You're ready to enable Code Signing. See [Turn on Code Signing](https://servicenow-prod.fluidtopics.net/MIqFrZIvFv5qJhYg_ygIWw "Turn on Code Signing in your trusted non-production instance to identify the trusted instances linking to your production instance.") to complete the steps.