---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Secure plugin with a certificate

# Secure a custom plugin with a certificate {#ariaid-title1}

* Release version: Yokohama
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

When you customize or create an Agent Client Collector plugin, you can secure the plugin with either a third-party certificate or an internal secure certificate in the plugin's script. Official plugins are signed by an external certificate
authority.

Using a signed certificate is enabled by default. To disable this feature, set the verify-plugin-signature property to False in the acc.yml on the host. When you disable a signed
certificate, your configured plugins use no certificate.

For details on how to configure a self-signed certificate by using OpenSSL, see [Enable OpenSSL secure signing for plugins](https://servicenow-prod.fluidtopics.net/EREVZSJ~ugZc1Tg6QMGytQ "Create a self-signed certificate for an Agent Client Collector plugin. The following procedure gives an example of how to create an x509 certificate using OpenSSL. For other certificate types, consult OpenSSL documentation."). For details on how to configure a third-party certificate, consult the third-party vendor's documentation.

When the agent's current certificates can't validate a plugin, Agent Client Collector requests the updated certificates from its synchronized MID Server. You can manually refresh the agent to receive these certificates before the scheduled synchronization. For details, see [Manually refresh Agent Client Collector certificates](https://servicenow-prod.fluidtopics.net/omPztdSSF~_MR2sxWkwg9g "Pull self-signed certificates from the ServiceNow install server, instead of waiting for the scheduled MID Server synchronization.").

You can manually save the certificates in a directory on the MID Server that is connected to the installed agents. Any agent that's installed in your environment can then access the certificates from that MID Server.

For details on how to configure the certificate synchronization properties, see [Synchronization properties for validating Agent Client Collector plugins](https://servicenow-prod.fluidtopics.net/U1XLKiqIcXmIBsmv3s7_vg "Use the following properties when synchronizing public certificates from the MID Server to the Agent Client Collector.").