---
sourceDocument: Australia ServiceNow AI Platform Capabilities
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Add SSL certificates for the MID Server

# Add SSL certificates for the MID Server {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

Configure the MID Server to connect to a source over SSL.

## Vorbereitungen

Role required: admin

|-|
|   |
[ ]

{#add-ssl-certificates__table_kvf_3v4_nhb}

## Warum und wann dieser Vorgang ausgeführt wird

You can add certificates to the MID Server to communicate over SSL/TLS in one of two ways:

* Add certificates directly to the bundled JRE TrustStore file, using the following procedure.
* Specify a different TrustStore file for the MID Server to use. For more information, see [Specify an external TrustStore for the MID Server](https://servicenow-prod.fluidtopics.net/Wze_LuvGY3XWJMv9a~ORjg#mid-external-truststore "The MID Server JVM can utilize a TrustStore external to the MID installation directory so any certificates added to the TrustStore are not overwritten during an upgrade. It is important that this TrustStore file reside outside of the MID installation directory, and the Truststore location can be specified by adding additional parameters to the MID Server's wrapper-override.conf file.").
{#add-ssl-certificates__ul_typ_fbz_2qb}Review both methods to evaluate which best meets your needs.  
During MID upgrade the bundled TrustStore is overwritten. The MID Server attempts to migrate certificates from the existing TrustStore to the incoming one. To be migrated, certificates must meet the following criteria:

Quebec (backported to Orlando Patch 10 and Paris Patch 4)
:
    * X.509 v3 certificates
    * Basic Constraints Extension evaluates to false (or is not present)
    {#add-ssl-certificates__ul_vrh_lbz_2qb}

Rome (backported to Paris Patch 7 and Quebec Patch 2)
:
    * X.509 certificates
    * Any certificate present in the source, but not the destination TrustStore
    {#add-ssl-certificates__ul_r14_nbz_2qb}

Certificates that do not meet the criteria are overwritten. Alternatively, you can
specify an external TrustStore file which is unaffected by MID Server upgrades. For
more information, see [Specify an external TrustStore for the MID Server](https://servicenow-prod.fluidtopics.net/Wze_LuvGY3XWJMv9a~ORjg#mid-external-truststore "The MID Server JVM can utilize a TrustStore external to the MID installation directory so any certificates added to the TrustStore are not overwritten during an upgrade. It is important that this TrustStore file reside outside of the MID installation directory, and the Truststore location can be specified by adding additional parameters to the MID Server's wrapper-override.conf file.")  
In Rome and later families, the migration strategy utilized during upgrade is configurable via the MID Server configuration parameter mid.truststore.migration.strategy. It can take the following values:

* migrate_delta: the default strategy (outlined above for Rome)
* migrate_non_ca: a strategy matching the one outlined above for the Quebec family
* do_not_migrate: disables the TrustStore migration during upgrade, though a backup of the original TrustStore is made in the event of overwrite
{#add-ssl-certificates__ul_ur1_pbz_2qb}

During this migration process, a backup of the original and upgrade TrustStores are
made and stored in the agent's work directory:
...\\agent\\work\\truststore_migration\\\<time epoch seconds\>\\.
The original TrustStore is renamed to cacerts_before and the
upgrade TrustStore is renamed to cacerts_from_upgrade.

## Prozedur

1. Open a command prompt and navigate to the folder containing the JRE [keytool](https://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html).  
   This is the location of the JRE you installed. An example path might be: C:\\Program Files\\Java\\jre1.8.0_161\\bin
2. Import a certificate into the MID Server's cacerts keystore, using this command:  
   `keytool -import -alias <certificate alias> -file "<path to
   certificate>" -keystore "<`path to the JRE`>\lib\security\cacerts"`

   For example, you might enter:
   `keytool -import -alias MyCA -file "C:\myca.cer" -keystore
   "C:\Program
   Files\Java\jre1.8.0_161\lib\security\cacerts"`  
   Hinweis:  
   The keytool prompts you for a certificate password. If the certificate is for a CA, the keytool also asks whether to trust the certificate authority. To add a certificate to an instance, see [Upload a certificate
   to an instance](https://www.servicenow.com/docs/access?context=t_UploadACertificateToAnInstance&version=australia&pubname=australia-platform-security&ft:locale=en-US).
3. **Wahlweise:** Display a list of the current certificates by running the command: `keytool.exe -list -keystore "C:\Mid
   Server\agent\jre\lib\security\cacerts"`
**Zugehörige Konzepte**   

* [MID Server certificate check policies](https://servicenow-prod.fluidtopics.net/VBqU5CHqCSU2m2xJd2a6uA "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.")
* [MID Server authentication credentials and SOAP requests](https://servicenow-prod.fluidtopics.net/80f2cul5Bjz0opflAxzxPg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.")
* [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.")
* [MID Server command audit log](https://servicenow-prod.fluidtopics.net/hMnNVhNJPmpY4gLr76lWAg "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to check for anomalies or errors.")
* [MID Server FIPS Enforced Mode](https://servicenow-prod.fluidtopics.net/dqBc9MICWmUraTd809_RJw#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.")
* [MID Server Governance](https://servicenow-prod.fluidtopics.net/aFXIuu3zlxcmFMjRZPM1Ug "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.")  
**Zugehörige Tasks**   

* [Encrypt or decrypt MID Server configuration file values](https://servicenow-prod.fluidtopics.net/iCgc9bn4JQYK9vgd1wAC6w "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.")
* [Enable MID Server mutual authentication](https://servicenow-prod.fluidtopics.net/UdSuWRmz6ZGA~Y6dkWvyeQ "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.")
* [MID Server Azure Key Vault integration](https://servicenow-prod.fluidtopics.net/q98R6SSVMU1wN5ZSqPpYrw#mid_azure_key_vault_integration "The MID Server integration with the Azure Key vault enables Orchestration, Discovery, and Service Mapping to run without storing any credentials on the instance.")
* [Rekey a MID Server](https://servicenow-prod.fluidtopics.net/pL97YclPNbf5hsjR6JhaEA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.")
* [Attach a script file to a file synchronized MID Server](https://servicenow-prod.fluidtopics.net/vu1Hjk_D3VmPooctXzxerQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.")  
**Zugehörige Verweise**   

* [MID Server configuration file security](https://servicenow-prod.fluidtopics.net/pExtHd2xoAcm8Vh~FXV9oQ "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.")
* [MID Server SSH cryptographic algorithms](https://servicenow-prod.fluidtopics.net/6XDl6hCCpG2wR7zHUqkWng "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")

## Specify an external TrustStore for the MID Server {#ariaid-title2}

The MID Server JVM can utilize a TrustStore external to the MID installation
directory so any certificates added to the TrustStore are not overwritten during an upgrade.
It is important that this TrustStore file reside outside of the MID installation directory,
and the Truststore location can be specified by adding additional parameters to the MID
Server's wrapper-override.conf file.

### Vorbereitungen

Role required: admin

### Prozedur

1. In the MID Server host, navigate to the wrapper-override.conf file.
2. Specify an external TrustStore by appending a custom parameter to the end of your MID's wrapper-override.conf file.  
   For example, on a Windows MID with an external TrustStore found at C:\\external_truststore\\cacerts, the end of the file would appear similar to:

       # Add additional custom parameters below

       wrapper.java.additional.3=-Djavax.net.ssl.trustStore=C:\external_truststore\cacerts

       wrapper.java.additional.4=-Djavax.net.ssl.trustStorePassword=<truststore's password>

   Hinweis:  
   If you have specified other additional parameters in this file then the numerical identifier, in this case 3 and 4, may differ.