---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Wrap your customer-supplied key

# Wrap your customer-supplied key {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Wrap your symmetric data encryption key with an ephemeral public wrapping key before you can upload it to your instance.

## Vorbereitungen

Role required: security_admin and sn_kmf.cryptographic_manager or sn_kmf.admin  
You must have a symmetric data encryption key in a `.bin` to use these steps. For instructions on this process, see [Configure Customer-supplied keys for Field Encryption Enterprise](https://servicenow-prod.fluidtopics.net/GY0Ufu_m8ZsV2CFOha7sJQ "Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.").  
Wichtig:  
Your symmetric data encryption key must be in a binary format (.BIN). If another format is used, the following error message:

Token failed validation. Please reattach the unmodified token.

## Warum und wann dieser Vorgang ausgeführt wird

To modify optional properties that control the size, padding algorithm, and validity period of the key, see [Configure properties for customer-supplied key](https://servicenow-prod.fluidtopics.net/W7lDxjbkzIHwlnk1jDooLQ "Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.").

You must have a cryptographic tool to wrap your key. The example in this document uses OpenSSL 1.1. For more information on OpenSSL, see details at <https://www.openssl.org>. If you're using other cryptographic tools, such as LibreSSL or GnuTLS, refer to the documentation for those products for similar steps.

## Prozedur

1. Navigate to AllSystem SecurityField EncryptionField Encryption Experience.
2. Select View module details from the Field Encryption modules overview to open the field encryption module that you've previously created.  
   Hinweis:  
   If you haven't created a field encryption module yet, you can create one using the steps in [Configure Field Encryption modules](https://servicenow-prod.fluidtopics.net/KgQtmTCEjA1_hC9IWbpg9A "Learn how to configure Field Encryption modules.").
3. In the Cryptographic Specification section, select Manage Specification Settings.
4. Select the Next button until you reach the Key Origin section.
5. Verify that the Origin field has a value of Upload customer supplied key.  
   If that value can't be selected, refer to steps 3--5 in [Configure Customer-supplied keys for Field Encryption Enterprise](https://servicenow-prod.fluidtopics.net/GY0Ufu_m8ZsV2CFOha7sJQ "Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.").
6. In the Key Alias field, create an alias.  
   Your key uses this alias once it's uploaded.
7. Select Next.
8. Select the link in the Download wrapping key field.  
   A token_publickey file downloads to your computer. Don't rename this file.
9. On your local machine, unzip and open the token_publickey folder.  
   You should see an import token file (.txt) and a public key file (.PEM) in this folder.
10. Move your symmetric data encryption key that you generated into this folder.
11. Copy the name of the token_publickey file to your clipboard.
12. Open a terminal session and navigate to the token_publickey folder.
13. Enter the following command:  
    Wichtig:  
    Replace any bracketed text (\<\>) with your specific file names and information. Use the following key wrapping command examples table as a guide.
    `openssl pkeyutl -encrypt -pubin
    -inkey publickey_<keyname>. PEM -in <keyname.bin> -out wrapped_key_material -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256`{#wrap-your-customer-supplied-key__table_ahy_fxk_f2c__entry__3}

    | Directions | Command | Example |
    |-|-|-|
    | Input the publickey_\<keyname\>.PEM | `openssl pkeyutl -encrypt -pubin -inkey publickey_<keyname>.PEM` | `openssl pkeyutl -encrypt -pubin -inkey publickey_567898643ffff.PEM` |
    | Input the name of your symmetric data encryption key | `-in <keyname.bin>` | `-in mykey.bin` |
    | Enter the \<-out\> command and specify whether the wrapped key material should use 256-bit encryption | `-out wrapped_key_material -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256` | NA |
    [Tabelle : 1. Key wrapping command examples]

    {#wrap-your-customer-supplied-key__table_ahy_fxk_f2c}

## Nächste Maßnahme

Now that your key is wrapped, you can upload it to your instance using the procedure in [Upload your customer-supplied key](https://servicenow-prod.fluidtopics.net/WcWpgNPLKkL8wY0pX8XZPw "Upload your wrapped symmetric data encryption key to your instance to begin using it work encryption.").