---
sourceDocument: Australia IT Service Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-service-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Sign ACC plugin

# Sign and verify an ACC plugin {#ariaid-title1}

Release version: Australia  
Updated March 9, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create a self-signed certificate for an Agent Client Collector (ACC) plugin and verify the signature to enable validation of the signed plugin on endpoint devices.

## Before you begin

* Create the ACC plugin tar.gz file on your local computer.
* Make sure that OpenSSL is installed on your local computer.
{#sign-verify-plugin__ul_n12_pc5_n3c}

Role required: admin

## Procedure

1. Generate a 2048-bit RSA key and a corresponding self-signed certificate with one year validity by using the following command:  

       openssl req -nodes -x509 -sha256 -newkey rsa:2048 -keyout "sign.key" -out "sign.crt" -days 365 -subj "/C=IN/ST=TG/L=HYD/O=servicenow/OU=acme/CN=sign"

   This command creates a private key (sign.key) and a public certificate (sign.crt).
2. Sign the plugin file with your private key.  

       openssl dgst -sha256 -sign "sign.key" -out sign.txt.sha256 <var class="keyword varname">plugin name</var>.tar.gz

3. Extract the public key from the certificate for signature verification.  

       openssl x509 -in "sign.crt" -pubkey -noout > pubkey.pem

4. Verify the signature using the public key to confirm the file was signed correctly.  

       openssl dgst -sha256 -verify pubkey.pem -signature sign.txt.sha256 <var class="keyword varname">plugin name</var>.tar.g

5. Encode the signature file using Base64 to enable the ACC agent to validate the plugin.
   * macOS

         base64 -i sign.txt.sha256 -o sign.txt.sha256_encode64.sig

   * Windows

         openssl enc -base64 -in sign.txt.sha256 -out sign.txt.sha256_encode64.sig

   {#sign-verify-plugin__choices_bfj_hl5_n3c}
6. Create a directory to store the signed plugin.  

       mkdir signed-plugin

7. Move the plugin archive and signature file to the new directory.  

       mv <var class="keyword varname">plugin name</var>.tar.gz signed-plugin/

       mv sign.txt.sha256_encode64.sig signed-plugin/

8. Navigate to the new directory.  

       cd signed-plugin

9. Create a tar.gz file containing both the plugin archive and the signature file.  

       tar -C . -zcvf ../sign-test.tar.gz *

10. Copy and place the self-signed certificate (sign.crt) in the certificate directory (\[agent_root\]/cert) of the ACC agent using one of the following options:
    * Copy the file manually.
    * Distribute the certificate to agent devices using a device management utility such as Jamf or Microsoft Intune.
    {#sign-verify-plugin__choices_nwr_yyr_p3c}
11. Add the certificate to the agent trust store.  
    For more information, see [Add a self-signed certificate to the OS truststore](https://www.servicenow.com/docs/access?context=add-certificate-trust-store&version=australia&pubname=australia-it-operations-management&ft:locale=en-US).
12. Upload the signed ACC plugin to the ServiceNow instance.  
    For more information, see [Create and edit Agent Client Collector plugins](https://www.servicenow.com/docs/access?context=create-edit-assets&version=australia&pubname=australia-it-operations-management&ft:locale=en-US).