---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Wrap your customer-supplied key

# Wrap your customer-supplied key {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Wrap the symmetric key to use for encryption with the downloaded public key.

## Vorbereitungen

Hinweis:  
This procedure describes options that are available with KMF base system and options to be used with Field Encryption Enterprise functionality. Field Encryption Enterprise functionality is available only when the com.glide.now.platform.encryption plugin is active. See [Activate Field Encryption](https://servicenow-prod.fluidtopics.net/d~sW4JlJZpz95XWViCzI5w "Activate either Field Encryption Starter or Field Encryption Enterprise.") for more information on obtaining Field Encryption Enterprise.

Some of the steps in this document require the use of a cryptographic tool installed
on your local device. The examples in this task use the OpenSSL tool. For more
information on this tool see <https://www.openssl.org>. If you are using other cryptographic tools, such as LibreSSL
or GnuTLS, refer to the documentation for those products for similar steps.  
* Modify optional properties that control the size, padding algorithm, and validity period of the key. See [Configure properties for customer-supplied keys](https://servicenow-prod.fluidtopics.net/Wg7gwmbhwjqas7ygpSOHmQ "If the Field Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.").
* You must have your symmetric key (.BIN) for encryption.

  Wichtig:  
  Your key must be in binary format. If another format is used, a `Token failed validation. Please reattach the unmodified token.`error message displays.
* You must have a cryptographic tool to wrap your key. This example uses
  OpenSSL 1.1.

{#wrap-customer-supplied-key__ul_s43_zmk_snb}

Role required: security_admin  and sn_kmf.cryptographic_manager  or sn_kmf.admin

## Prozedur

1. Navigate to AllSystem SecurityField EncryptionField Encryption Experience.
2. Select View module details for the cryptographic module that you created for the customer-supplied key from the Field Encryption modules overview.
3. Select the Add encryption key option from the Complete these steps in any order to set up the module section.
4. Select Select and continue under the Bring-your-own-key option.
5. You will be directed to the Key Creation step.
6. If you have not previously downloaded the wrapping key, click the link to download the token_publickey\<id\>.zip file and save it to the same location as your key.  
   Hinweis:  
   Do not rename the downloaded token_publickey\<id\> file.
7. Unzip the file to your local network.  
   The zip file contains two files, an import token and a public key `.PEM` certificate. Wrap your symmetric key with the public key to encrypt it.
8. Copy the name of the token_publickey file to your clipboard.
9. From a command line, use the copied token_publickey file name to open the folder of the unzipped files as a placeholder for the wrapped key.
10. Edit this script by replacing the examples with the names of your crypto files.  

        "downloads user.name$ cd `token_publickey_<token>`
        openssl pkeyutl -encrypt -pubin -inkey `publickey_<keyname>.PEM`
        -in `<keyname.bin>`
        -out wrapped_key_material -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha<128 or 256> "

    Review the key wrapping commands in the following table for more information.  
    {#wrap-customer-supplied-key__table_azx_3yk_snb__entry__3}

    | Directions | Command | Example |
    |-|-|-|
    | Open the file directory where you downloaded the wrapping token. | cd | `cd token_publickey123456789` |
    | Paste the name of the `publickey.PEM` certificate. | openssl pkeyutl -encrypt -pubin -inkey | `publickey_586798643ffff.PEM` |
    | Paste the name of your key here. | -in | `mykey.bin` |
    | Enter the \<-out\> command and specify if the key is 128 bit or 256 bit. | -out wrapped_key_material -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 | N/A |
    [Tabelle : 1. Key wrapping commands]

    {#wrap-customer-supplied-key__table_azx_3yk_snb}
11. Run the command.  
    A system message displays `token_publickey_<keynumber>`. The key will be generated and a wrapped_key_material file added to the directory.
12. Upload the wrapped key.

## Nächste Maßnahme

Return to [Configure and upload your customer supplied key](https://servicenow-prod.fluidtopics.net/EI6~rDwd7ENC_Q_Px6k0JQ "You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.")
to upload your wrapped key.