--- sourceDocument: Australia ServiceNow AI Platform Capabilities sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform Release : - australia ft:locale : - de-DE ft:publication_title : - Australia ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # Enable MID Server mutual authentication # Enable MID Server mutual authentication {#ariaid-title1} * Freigeben Version: Australia * * Aktualisiert 12. März 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 Minuten Lesedauer Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration. ## Vorbereitungen Role required: admin |-| | | [ ] {#install-mid-mutual-auth__table_jjd_jmj_bpb} ## Warum und wann dieser Vorgang ausgeführt wird MID Server mutual authentication removes the MID Server user name and password and provides a client certificate for authentication. Whenever a server requests authentication, this certificate is sent instead. To use mutual authentication, certificate based authentication must be enabled. See [Set up Certificate-based authentication](https://www.servicenow.com/docs/access?context=set-up-mutual-auth&version=australia&pubname=australia-platform-security&ft:locale=en-US) for the procedure. If a new MID Server is created with mutual authentication, it does not add capabilities automatically. An administrator must add capabilities to its record on the instance. However, existing MID Servers using basic authentication with capabilities are preserved when switching to mutual authentication. A MID Server using mutual authentication cannot be re-keyed or validated as a UI action on the instance. Self-signed certificates are not supported with mutual authentication. Internally signed certificates are only supported when signed by a private certificate authority. Commercially signed certificates are supported when signed by a commonly trusted certificate authority, such as those trusted by browsers and operating systems. In the Quebec release, a MID Server using the Health Log Analytic application cannot be configured with mutual authentication. ## Prozedur 1. Contact ServiceNow support to request mutual authentication on the MID Server. 2. Obtain a certificate and private key from a respected certificate authority. MID Server mutual authentication only supports the PEM bundle format and private key in PCKS#8 format. The bundle must have both the private key and certificate. Open the certificate using a text editor and see if it is in text format. The header and footer of the PEM syntax is the following: -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- You can read the contents of a PEM certificate using the `openssl` command on Linux or Windows as follows: `openssl x509 -in cert.crt -text `. The private key must be in the PKCS#8 format. The header and footer of the PKCS#8 syntax is the following: -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY-----   You can check the contents of a private key using the `openssl` command on Linux or Windows as follows: ` openssl rsa -in private.key -check ` Hinweis: If your certificate is not in PKCS#8 format, you get an error: `- main SEVERE *** ERROR *** Could not find valid private key` 3. Split up the PEM certificate into 3 different PEM files. 1. Private key and leaf certificate 2. Leaf certificate 3. Intermediate certificates and root certificate {#install-mid-mutual-auth__ol_zlk_gzx_dfc} 4. On the instance, upload file containing the intermediate and root certificates to the CA Certificate Chain table: sys_ca_certificate.list. Hinweis: If uploading individually instead of a bundle, start with the root certificate, and then the intermediate certificate(s). It is preferrable to uploade this file as a PEM bundle, whose type is set to CA Cert, instead of splitting it into multiple files. 5. Check the uploaded CA Cert record on the instance and wait for the Publish Status to change to Exists. Hinweis: Do not proceed until the publish status is updated to Exists. 6. On the instance, navigate to sys_user_certificate.list. 7. Attach only the leaf certificate to sys_user_certificate.list without including the private key. 8. If the MID Server is validated, invalidate the MID Server before continuing. 9. Create a new record. Hinweis: The record must have the MID Server's name and the User Role must be MID Server. 10. Attach the original, unsplit PEM certificate to the record. Hinweis: Ensure that the attached file contains only the certificate. 11. If the MID Server is running, stop the MID Server. 12. On the MID Server host machine, run the following commands to install and manage the certificate and private key. Run the script from the root of the agent directory because it requires the jar files in the class path. The security directory is then created in the agent root folder and is used by MID Server. For example: `bin/scripts/manage-certificates.bat -m.` The manage-certificates has the following functions and the scripts must be run from the agent folder. Enable mutual authentication​ : For Windows, use the command: `bin/scripts/manage-certificates.bat -m` For Linux, use the command: `./bin/scripts/manage-certificates.sh -m` Remove mutual authentication and restore back basic authentication : For Windows, use the command: `bin/scripts/manage-certificates.bat -b ` For Linux, use the command: `./bin/scripts/manage-certificates.sh -b ` Add new certificates and certificate chains with a specified alias​ : For Windows, use the command: `bin/scripts/manage-certificates.bat -a ` For Linux, use the command: `./bin/scripts/manage-certificates.sh -a ` The `alias` is a unique name given to the certificate being imported. The MID Server requires a custom certificate for mutual authentication, with the default alias name `defaultsecuritykeypairhandle`. To configure MTLS communication between the MID Server and instance, the certificate entry must be added to the key store using the alias name `defaultsecuritykeypairhandle`. The `fileName` is a file path that can contain a PEM certificate, or certificate chain, and a PCKS#8 private key. The file path to the PEM bundle can contain multiple certificates and a single private key. The header and footer of each PEM certificate must be the following: -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- The header and footer of the PKCS#8 syntax must be the following: -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- An exception is thrown if the certificate chain fails validation. If the file contains multiple certificates, they must be ordered: leaf certificate, intermediate certificates, then root certificates. Display certificate details for the specified alias : For Windows, use the command: `bin/scripts/manage-certificates.bat -g ​` For Linux, use the command: `./bin/scripts/manage-certificates.sh -g ​` This command displays information such as subject distinguished name, issuer name, and expiry date from the certificate. List all existing aliases : For Windows, use the command: `bin/scripts/manage-certificates.bat -l` For Linux, use the command: `./bin/scripts/manage-certificates.sh -l` This command lists all the alias names available in the agent_keystore. Delete certificates using an alias​ : For Windows, use the command: `bin/scripts/manage-certificates.bat -d ` For Linux, use the command: `./bin/scripts/manage-certificates.sh -d ` This command deletes the alias and record from the keystore. The entry for alias DefaultSecurityKeyPairHandle can be deleted using this command. Remove all entries from the keystore : For Windows, use the command: `bin/scripts/manage-certificates.bat -r ​` For Linux, use the command: `./bin/scripts/manage-certificates.sh -r ​` This command deletes the existing entries from the keystore, except alias DefaultSecurityKeyPairHandle. ​ 13. Start the MID Server. **Zugehörige Konzepte** * [MID Server certificate check policies](https://servicenow-prod.fluidtopics.net/VBqU5CHqCSU2m2xJd2a6uA "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.") * [MID Server authentication credentials and SOAP requests](https://servicenow-prod.fluidtopics.net/80f2cul5Bjz0opflAxzxPg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.") * [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") * [MID Server command audit log](https://servicenow-prod.fluidtopics.net/hMnNVhNJPmpY4gLr76lWAg "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to check for anomalies or errors.") * [MID Server FIPS Enforced Mode](https://servicenow-prod.fluidtopics.net/dqBc9MICWmUraTd809_RJw#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.") * [MID Server Governance](https://servicenow-prod.fluidtopics.net/aFXIuu3zlxcmFMjRZPM1Ug "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.") * [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") **Zugehörige Tasks** * [Encrypt or decrypt MID Server configuration file values](https://servicenow-prod.fluidtopics.net/iCgc9bn4JQYK9vgd1wAC6w "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") * [MID Server Azure Key Vault integration](https://servicenow-prod.fluidtopics.net/q98R6SSVMU1wN5ZSqPpYrw#mid_azure_key_vault_integration "The MID Server integration with the Azure Key vault enables Orchestration, Discovery, and Service Mapping to run without storing any credentials on the instance.") * [Rekey a MID Server](https://servicenow-prod.fluidtopics.net/pL97YclPNbf5hsjR6JhaEA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.") * [Add SSL certificates for the MID Server](https://servicenow-prod.fluidtopics.net/Wze_LuvGY3XWJMv9a~ORjg#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.") * [Attach a script file to a file synchronized MID Server](https://servicenow-prod.fluidtopics.net/vu1Hjk_D3VmPooctXzxerQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.") * [Install custom certificates in the MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore-install "Install custom certificates to unify the security channels for various applications.") **Zugehörige Verweise** * [MID Server configuration file security](https://servicenow-prod.fluidtopics.net/pExtHd2xoAcm8Vh~FXV9oQ "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.") * [MID Server SSH cryptographic algorithms](https://servicenow-prod.fluidtopics.net/6XDl6hCCpG2wR7zHUqkWng "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")