--- sourceDocument: Australia ServiceNow AI Platform Capabilities sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/servicenow-platform Release : - australia ft:locale : - de-DE ft:publication_title : - Australia ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # Set up a secure connection # Set up a secure connection to the Hermes Messaging Service {#ariaid-title1} * Freigeben Version: Australia * * Aktualisiert 12. März 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer Secure your Kafka topics by generating a ServiceNow® instance-signed certificate. ## Vorbereitungen Setting up the Hermes Messaging Service requires coordination with your network administrator and with your Kafka administrator. Work with your network administrator to obtain required security certificates and open the required ports. Work with your Kafka administrator to ensure that your Kafka environment is configured correctly and that your applications can connect to the Hermes Messaging Service using the standard Kafka protocol. Make sure the following setup is in place: * The Hermes Messaging Service is activated. See [Activating the Hermes Messaging Service](https://servicenow-prod.fluidtopics.net/KOSq4bAeHFdF0AfJ2CO~xA "The Hermes Messaging Service is enabled when the Glide Hermes Message Queue plugin (com.glide.hermes) is activated."). * The Key Management Framework plugin (com.glide.kmf.global) is activated. * The Certificates \[sys_kmf_certificate\] table contains a ServiceNow instance root CA certificate. * The instance isn't configured with a Custom URL. Custom URLs are not supported with the Instance PKI Certificate Generator. {#set-up-secure-connection-to-hermes__ul_wp2_lfp_fvb} Role required: hermes_admin, sn_kmf.cryptographic_manager, or admin For details on assigning KMF roles, see [Roles installed with Key Management Framework](https://www.servicenow.com/docs/access?context=kmf-roles&version=australia&pubname=australia-platform-security&ft:locale=en-US). ## Prozedur 1. Navigate to AllCertificate GeneratorInstance PKI Certificate Generator. 2. **Wahlweise:** Control access to topics by configuring Access Control Lists (ACLs) at the namespace or topic-level. | Option | Description | | Apply ACLs to namespaces | 1. Select Configure ACLs. 2. In the Topic ACLs dialog box, select Namespaces. 3. Enter a namespace that you want to configure. 4. Set the permission level by selecting either Read Only or Read/Write. 5. Select Add. {#set-up-secure-connection-to-hermes__ol_qm5_lkn_zyb} | | Apply ACLs to defined topics | 1. Select Configure ACLs. 2. In the Topic ACLs dialog box, select Defined topics. 3. Enter an existing topic that you want to configure. 4. Set the permission level by selecting either Read Only or Read/Write. 5. Select Add. {#set-up-secure-connection-to-hermes__ol_etm_n4t_zyb} | |-|-| {#set-up-secure-connection-to-hermes__choicetable_ebz_1jn_zyb} The bearer of the certificate is granted read or read/write access to the topics in the namespace or the existing topic that you selected. 3. Set up security for the Hermes Messaging Service. 1. Navigate back to the Instance PKI Certificate Generator page. 2. Enter a keystore password in the Certificate Password field. 3. Select Generate. {#set-up-secure-connection-to-hermes__substeps_gnt_jzd_wxb} The system generates an instance-signed certificate in the Certificates \[sys_kmf_certificate\] table, creates a keystore, and creates a truststore. If Restricted Caller Access isn't allowed for the IPKI Certificate Generator, a cross scope access error appears. Contact Customer Service and Support for assistance with allowing Restricted Caller Access. To resolve this issue, Customer Service and Support can reference source_scope=76f9d51369115083f4ea77aab1677cc0 in the Restricted Caller Access Privileges \[sys_restricted_caller_access\] table. 4. Save a copy of the keystore by selecting Download Keystore. 5. Save a copy of the truststore by selecting Download Truststore. 6. Copy the keystore and truststore files to each producer and consumer client that will connect to the Hermes Messaging Service. {#set-up-secure-connection-to-hermes__steps_rxf_543_qcc} ## Ergebnisse You can now create a secure connection to the Hermes Messaging Service. Hinweis: You must use the keystore that you generated using the Instance PKI Certificate Generator to connect to Hermes. Custom-generated keystores that aren't created according to the ServiceNow documentation aren't supported. ## Nächste Maßnahme * Review the guidance in [Exchanging data using Hermes](https://servicenow-prod.fluidtopics.net/hQiGdoHfk8tp6zcL0M2DKA "Produce and consume Kafka messages in your ServiceNow instance using the Hermes Messaging Service."). * [Prepare your Apache Kafka client environment](https://servicenow-prod.fluidtopics.net/ZYiWlqUuWuaSEoXKY4w3kg "Install the Apache Kafka binaries on your Unix or Windows client machine.") * Configure the SSL connection to Hermes in the producer and consumer properties files using the truststore and keystore files that you generated. For more information, refer to the following topics: * [Create a test topic in Hermes using the Kafka client](https://servicenow-prod.fluidtopics.net/yRi94EGo~4Y5VlscX_qriQ "Create a topic for sending and receiving test messages in the Hermes Kafka cluster.") * [Produce test messages to a Hermes topic using the Kafka client](https://servicenow-prod.fluidtopics.net/Z1US2uFaPjqGrMMt7EVNQw "Produce test messages to a Hermes topic by configuring a producer client.") * [Consume test messages from a Hermes topic using the Kafka client](https://servicenow-prod.fluidtopics.net/ioy34lJ2fhvpQvDlXSYbZw "Consume test messages from a Hermes topic by configuring two consumer clients.") {#set-up-secure-connection-to-hermes__ul_rws_4wf_qyb} {#set-up-secure-connection-to-hermes__ul_p1h_tj3_qcc} **Zugehörige Konzepte** * [Activating the Hermes Messaging Service](https://servicenow-prod.fluidtopics.net/KOSq4bAeHFdF0AfJ2CO~xA "The Hermes Messaging Service is enabled when the Glide Hermes Message Queue plugin (com.glide.hermes) is activated.") * [Restricting access to Hermes](https://servicenow-prod.fluidtopics.net/_Jj0YvT_EXXF2xknL0svWQ "Restrict access to Hermes by IP address.") **Zugehörige Tasks** * [Revoke a Hermes certificate](https://servicenow-prod.fluidtopics.net/POq_ScksyNItCJFVwLR5OQ "Revoke a ServiceNow instance-signed certificate so that it can't be used in secure connections to the Hermes Messaging Service.")