--- sourceDocument: Australia ServiceNow AI Platform Capabilities sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform Release : - australia ft:locale : - de-DE ft:publication_title : - Australia ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # MID Server configuration file security # MID Server configuration file security {#ariaid-title1} * Freigeben Version: Australia * * Aktualisiert 12. März 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage. |-| | | [ ] {#mid-server-encrypter-api__table_vbn_2v4_nhb} The MID Server provides the following built-in security options for content in the config.xml file: * Default security provider: Secures the data in the config.xml file by encryption. When the MID Server is restarted, any unencrypted data is encrypted and written to the config.xml file. The default security provider offers these encryption options: * Default encryptor: Default process for encrypting data in the MID Server config.xml file. See [Encrypt or decrypt MID Server configuration file values](https://servicenow-prod.fluidtopics.net/iCgc9bn4JQYK9vgd1wAC6w "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") for details. * Windows Data Protection API (DPAPI): The operating system performs the data encryption, rather than the MID Server. DPAPI encryption is based on the logged in user's account. When this scheme is used, the data can only be decrypted by the same user account. If the account changes, the data must be re-encrypted. {#mid-server-encrypter-api__ph_dpapi-explaination} * Custom encryption: Implement the [IMidServerEncrypter interface](https://servicenow-prod.fluidtopics.net/6dmq1RzN2~dkAR5iL_yeJw "Use the methods in this interface to create a custom external encrypter for the MID Server config.xml file.") to create your own custom encryption scheme to manage sensitive config.xml data. {#mid-server-encrypter-api__ul_xsq_5wx_4bb} * * CyberArk: Data security is provided by [CyberArk integration configuration](https://www.servicenow.com/docs/access?context=c_CyberArkIntegrationConfiguration&version=australia&pubname=australia-platform-security&ft:locale=en-US), which moves sensitive data from the config.xml file to a secure CyberArk vault. This solution does not encrypt the data. * Custom external storage: Implement the [ISecuredConfigProvider interface](https://servicenow-prod.fluidtopics.net/3J~XhXLSWxGbQNE5TzOsiw "Use the methods in this interface to create custom providers that manage secured parameter values in the MID Server config.xml file.") to create your own custom external storage system to manage sensitive config.xml data. {#mid-server-encrypter-api__ul_mqg_n4q_x1b} Abbildung : 1. Secured content and encryption schemes * **[Encrypt MID Server configuration data with DPAPI](https://servicenow-prod.fluidtopics.net/wUXUfwZK9kwej9hnjoQ75A)** Windows Data Protection API (DPAPI) encrypts sensitive data from the config.xml file, based on the MID Server user account. * **[Use CyberArk as a secure configuration provider](https://servicenow-prod.fluidtopics.net/S_k7RfZq2UQuH3ck7r1jmQ)** You can use a CyberArk vault to secure any sensitive data from the MID Server config.xml file. * **[Change MID Server configuration file security schemes](https://servicenow-prod.fluidtopics.net/DKUZLG5uAtGdrCmAPd3LGQ)** The MID Server provides several schemes for securing sensitive data in the config.xml file and allows you to switch between these options to suit your security requirements. * **[MID Server ISecuredConfigProvider interface](https://servicenow-prod.fluidtopics.net/3J~XhXLSWxGbQNE5TzOsiw)** Use the methods in this interface to create custom providers that manage secured parameter values in the MID Server config.xml file. * **[MID Server IMidServerEncrypter interface](https://servicenow-prod.fluidtopics.net/6dmq1RzN2~dkAR5iL_yeJw)** Use the methods in this interface to create a custom external encrypter for the MID Server config.xml file. **Zugehörige Konzepte** * [MID Server certificate check policies](https://servicenow-prod.fluidtopics.net/VBqU5CHqCSU2m2xJd2a6uA "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.") * [MID Server authentication credentials and SOAP requests](https://servicenow-prod.fluidtopics.net/80f2cul5Bjz0opflAxzxPg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.") * [MID Server unified key store](https://servicenow-prod.fluidtopics.net/zWbtuI59iqjA5LfLDw8VPA#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") * [MID Server command audit log](https://servicenow-prod.fluidtopics.net/hMnNVhNJPmpY4gLr76lWAg "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to check for anomalies or errors.") * [MID Server FIPS Enforced Mode](https://servicenow-prod.fluidtopics.net/dqBc9MICWmUraTd809_RJw#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.") * [MID Server Governance](https://servicenow-prod.fluidtopics.net/aFXIuu3zlxcmFMjRZPM1Ug "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.") **Zugehörige Tasks** * [Encrypt or decrypt MID Server configuration file values](https://servicenow-prod.fluidtopics.net/iCgc9bn4JQYK9vgd1wAC6w "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") * [Enable MID Server mutual authentication](https://servicenow-prod.fluidtopics.net/UdSuWRmz6ZGA~Y6dkWvyeQ "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.") * [MID Server Azure Key Vault integration](https://servicenow-prod.fluidtopics.net/q98R6SSVMU1wN5ZSqPpYrw#mid_azure_key_vault_integration "The MID Server integration with the Azure Key vault enables Orchestration, Discovery, and Service Mapping to run without storing any credentials on the instance.") * [Rekey a MID Server](https://servicenow-prod.fluidtopics.net/pL97YclPNbf5hsjR6JhaEA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.") * [Add SSL certificates for the MID Server](https://servicenow-prod.fluidtopics.net/Wze_LuvGY3XWJMv9a~ORjg#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.") * [Attach a script file to a file synchronized MID Server](https://servicenow-prod.fluidtopics.net/vu1Hjk_D3VmPooctXzxerQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.") **Zugehörige Verweise** * [MID Server SSH cryptographic algorithms](https://servicenow-prod.fluidtopics.net/6XDl6hCCpG2wR7zHUqkWng "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")