---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Connect the agent to the MID Server using mTLS

# Connect the agent to the MID Server using mTLS {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Before configuring mTLS authentication on the agent, you must run a series of commands that enable configuring Transport Layer Security (TLS) authentication.

## Before you begin

Ensure that you have performed the following tasks:

1. [Create keys and certificates](https://servicenow-prod.fluidtopics.net/7khjURV6QwpOY6NpnvGsyA "Create keys and certificates in your root directory to enable Transport Layer Security (TLS) setup. TLS setup is necessary before you can configure mTLS on the MID Web Server and agent.")
2. [Set up the MID Web Server with a .pem file](https://servicenow-prod.fluidtopics.net/zEhh1LCUgaECAkon8NCNuw "Install the .pem file into the MID unified keystore and set up the MID Web Server to enable configuring mTLS on your MID Web Server and agent.")
3. [Connect the agent to the MID Web Server using TLS](https://servicenow-prod.fluidtopics.net/56b64d1EAbWq9r8eRitIIw "Connect the agent to the MID Web Server to enable configuring mTLS on your MID Web Server and agent.")
4. [Configure mTLS authentication for a MID Web Server](https://servicenow-prod.fluidtopics.net/zgZd4l4Sj1MUzveZwd7CmQ "Enhance security in your MID Web Server extension by enabling mTLS authentication.")
5. [Connect the agent to the MID Server using mTLS](https://servicenow-prod.fluidtopics.net/ZMhnE1YVvmuFaQJw8FpPjA "Before configuring mTLS authentication on the agent, you must run a series of commands that enable configuring Transport Layer Security (TLS) authentication.")
{#enable-tls-agent__ol_nwp_3f5_xbc}

Role required: agent_client_collector_admin

## Procedure

1. Generate a key for your agent.  

       openssl ecparam -out labacc/acc.key -name prime256v1 -genkey

2. Generate a certificate request for your agent, according to the following format:  

       openssl req -new -key labacc/acc.key -out labacc/acc.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<cn abbreviation>/emailAddress=<email address>"

   For example:

       openssl req -new -key labacc/acc.key -out labacc/acc.csr -subj "/C=US/ST=NC/L=Raleigh/O=ServiceNow/OU=ITOM Lab/CN=acclinux/emailAddress=john.smith@servicenow.com"

3. Generate a signed certificate for your agent.  

       openssl x509 -req -days 365 -in labacc/acc.csr -CA labca/labcacert.pem -CAkey labca/ec-labcakey.pem -CAcreateserial -extensions client -out labacc/acc.crt

4. In the labacc folder, copy your key and certificate files to the agent host's virtual machine.  

       cp ./acc.key <agent host config folder>
       cp ./acc.crt <agent host config folder>

   The configuration folder paths depend on your OS.
   * Linux: /etc/servicenow/agent-client-collector/
   * Windows: C:\\ProgramData\\servicenow\\agent-client-collector\\config\\
   * macOS: /Library/Application\\ Support/servicenow/agent-client-collector/
   {#enable-tls-agent__ul_hbw_nb5_vbc}
5. Navigate to the location where you copied the .key and .crt files from.
6. Run the following commands to update the files' read permissions and enable the agent to read from them.  
   * Linux:
     1. `chown servicenow:servicenow acc.key`
     2. `chmod 0400 acc.key`
     {#enable-tls-agent__ol_nfh_bg5_vbc}
   * Windows:
     1. Select and hold (or right-click) the .key file and select the Security tab from the file properties.
     2. Add the servicenow user to the list of users with read access to the file.
     {#enable-tls-agent__ol_c5c_fg5_vbc}
   * macOS:
     1. `chown _servicenow:_servicenow acc.key`
     2. `chmod 0400 acc.key`
     {#enable-tls-agent__ol_o1x_f35_vbc}

   {#enable-tls-agent__ul_zkj_bd5_vbc}  
   Note:  
   The agent must be run with the default servicenow user.
7. In the acc.yml configuration file, add the following parameters to specify the path to your key and certificate files.  

       key-file: "<path to acc.key file>/acc.key"
       cert-file: "<path to acc.cert file>/acc.crt"

8. Restart the agent.  
   * Linux: `systemctl restart acc`
   * Windows:
     1. Open the Services application.
     2. Select and hold (or right-click) the Agent Client Collector entry and select Restart.
     {#enable-tls-agent__ol_tjd_r35_vbc}
   * macOS:
     1. `launchctl unload -w /Library/LaunchDaemons/com.sn.acc.plist`
     2. `launchctl load -w /Library/LaunchDaemons/com.sn.acc.plist`
     {#enable-tls-agent__ol_an1_2j5_vbc}
   {#enable-tls-agent__ul_ikx_m35_vbc}
9. Check the logs to verify that the agent was able to connect to the instance using TLS.  
   Agent Client Collector logs are accessible from:
   * Linux: /var/log/servicenow/agent-client-collector/acc.log
   * Windows: The location specified by the `log-file` configuration flag. The default location is: C:/ProgramData/ServiceNow/agent-client-collector/log/acc.log

     If the C:/ProgramData directory is hidden (such as on older Windows versions), change the Explorer filter to show hidden elements.
   * macOS: The default location is: /Library/Application\\ Support/servicenow/agent-client-collector/log/acc.log
   {#enable-tls-agent__ul_nj4_2j2_5bc}
**Related concepts**   

* [MID Web Server and agent mTLS Authentication](https://servicenow-prod.fluidtopics.net/H5M4AD_YkGgzKe40o1Fb~w "Mutual authentication using the Transport Layer Security protocol (mTLS) is a secure, certificate-based authentication scheme. With mTLS, the server (the MID Web Server extension) and the client (the agent) authenticate each other.")