---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# CertificateEncryption - Scoped

# CertificateEncryption - Scoped {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

The CertificateEncryption API provides methods for encrypting certificates in scoped applications.

Use these methods to generate a hash for the certificate, sign data using a private key, and
generate a message authentication code.

## CertificateEncryption - CertificateEncryption() {#ariaid-title2}

Instantiates a CertificateEncryption object in a scoped application.
{#r-SCE-CE__table_e1m_npx_vz__entry__3}

| Name | Type | Description |
|-|-|-|
| None |   |   |
[Table 1. Parameters]

{#r-SCE-CE__table_e1m_npx_vz}

## CertificateEncryption - generateMac(String key, String algorithm, String data) {#ariaid-title3}

Generates the Message Authentication Code (MAC), which is used to authenticate a
message.
{#r_SCE-generateMac_S_S_S__table_nm3_gcc_ks__entry__3}

| Name | Type | Description |
|-|-|-|
| key | String | Key to use to sign the message. Must be Base64 encoded. |
| algorithm | String | Algorithm to use to generate the MAC: HmacSHA256, HmacSHA1, HmacMD5, and so on. |
| data | String | Data to process. |
[Table 2. Parameters]

{#r_SCE-generateMac_S_S_S__table_nm3_gcc_ks} {#r_SCE-generateMac_S_S_S__table_om3_gcc_ks__entry__2}

| Type | Description |
|-|-|
| String | MAC in base64 format. |
[Table 3. Returns]

{#r_SCE-generateMac_S_S_S__table_om3_gcc_ks}  
This example shows how to a MAC using sample_key as the data and HmacSHA256 as the
algorithm.

    var mac = new CertificateEncryption;
    var key = "sample_key"; 
    key = gs.base64Encode(key);
    mac.generateMac(key, "HmacSHA256", "sample_data");

## CertificateEncryption - getThumbPrint(String certificateID, String algorithm) {#ariaid-title4}

Generates a hash (SHA-1, SHA-256, and so on) for the certificate from Trust Store
Cert.
{#r_SCE-getThumbPrint_S_S__table_edb_rmv_js__entry__3}

| Name | Type | Description |
|-|-|-|
| certificateID | String | Sys_id of the certificate record in the X.509 Certificate \[sys_certificate\] table. |
| algorithm | String | Algorithm to use to create the hash, such as SHA-1, SHA-256, and so on. |
[Table 4. Parameters]

{#r_SCE-getThumbPrint_S_S__table_edb_rmv_js} {#r_SCE-getThumbPrint_S_S__table_fdb_rmv_js__entry__2}

| Type | Description |
|-|-|
| String | Thumbprint in base64 format. |
[Table 5. Returns]

{#r_SCE-getThumbPrint_S_S__table_fdb_rmv_js}  
This example shows how to generate the thumbprint (hash) for the AzureAAD certificate.

    //Create a GlideRecord to the certificate table
    var x509GR = new GlideRecord('sys_certificate');

    //If there is a certificate of a name of AzureAAD, get the certificate thumbprint
    if(x509GR.get('name', 'AzureAAD')){

    //Use the sys_id and algorithm we want to create a thumbprint
    var thumbPrint = CertificateEncryption.getThumbPrint(x509GR.getUniqueValue(), "SHA-1");

    //Print the created thumbprint
    gs.print("Thumbprint for " + x509GR.getDisplayValue() + " is " + thumbPrint);
    }

Output:

    V1X+aguDBTZVVbWMGTXxdzJLmaY=

## CertificateEncryption - getThumbPrintFromKeyStore(String certificateID, String alias,
String algorithm) {#ariaid-title5}

Generates a hash (SHA-1, SHA-256, and so on) for the certificate from the keystore
entry.
{#r_SCE-getThumbPrintFromKeyStore_S_S_S__table_edb_rmv_js__entry__3}

| Name | Type | Description |
|-|-|-|
| certificateID | String | Sys_id of the certificate record in the X.509 Certificate \[sys_certificate\] table. |
| alias | String | Alias name for the certificate. |
| algorithm | String | Algorithm to use to create the hash, such as SHA-1, SHA-256, and so on. |
[Table 6. Parameters]

{#r_SCE-getThumbPrintFromKeyStore_S_S_S__table_edb_rmv_js} {#r_SCE-getThumbPrintFromKeyStore_S_S_S__table_fdb_rmv_js__entry__2}

| Type | Description |
|-|-|
| String | Thumbprint in base64 format. |
[Table 7. Returns]

{#r_SCE-getThumbPrintFromKeyStore_S_S_S__table_fdb_rmv_js}

## CertificateEncryption - sign(String certificateID, String alias, String aliaspassword,
String algorithm, String datatosign) {#ariaid-title6}

Signs the data using the private key and the specified algorithm.
{#r_SCE-sign_certificateID_S_S_S_S__table_edb_rmv_js__entry__3}

| Name | Type | Description |
|-|-|-|
| certificateID | String | sys_id of the certificate record in the X.509 Certificate \[sys_certificate\] table. |
| alias | String | Private key name. |
| aliaspassword | String | Password for the private key. |
| algorithm | String | Algorithm to use. Must be one of the following values: * NONEwithRSA * MD2withRSA * MD5withRSA * SHA1withRSA * SHA224withRSA * SHA256withRSA * SHA384withRSA * SHA512withRSA * NONEwithDSA * SHA1withDSA * SHA224withDSA * SHA256withDSA * NONEwithECDSA * SHA1withECDSA * SHA224withECDSA * SHA256withECDSA * SHA384withECDSA * SHA512withECDSA {#r_SCE-sign_certificateID_S_S_S_S__ul_pr3_nvv_pkb} |
| datatosign | String | Data to sign. |
[Table 8. Parameters]

{#r_SCE-sign_certificateID_S_S_S_S__table_edb_rmv_js} {#r_SCE-sign_certificateID_S_S_S_S__table_r3m_jcb_ks__entry__2}

| Type | Description |
|-|-|
| String | Signed data in base64 format. |
[Table 9. Returns]

{#r_SCE-sign_certificateID_S_S_S_S__table_r3m_jcb_ks}  

    var ce = new CertificateEncryption;
    ce.sign("recordID", "alias", "password", "SHA1withRSA", "sign this data");