Exploring Code Signing

  • Release version: Yokohama
  • Updated March 20, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Exploring Code Signing

    Code Signing in ServiceNow provides cryptographic verification to ensure that only authorized scripts can execute on MID Servers, safeguarding integrations between ServiceNow and external systems. It creates digital signatures to validate the authenticity and integrity of data processed by MID Servers, preventing unauthorized or tampered execution. Code Signing is a licensed module within ServiceNow Vault and requires access granted by the Customer Service and Support team. It relies on the Key Management Framework (KMF) and industry-standard asymmetric encryption to facilitate secure digital signatures.

    Show full answer Show less

    Code Signing operates within a secure Circle of Trust (COT) between trusted and protected instances, ensuring only authorized instances can use the feature. Note that Code Signing is enabled on the protected instance, not the trusted instance.

    How Code Signing Protects Your Environment

    Without Code Signing, attackers could alter ServiceNow records (such as SQL statements), leading to malicious code execution on MID Servers and compromising system security. With Code Signing and Circle of Trust architecture, data transferred to MID Servers undergoes signature verification, allowing only authorized, signed code from trusted instances to execute.

    • Data sources created or updated in the trusted instance are digitally signed.
    • Signed data is transferred to the protected instance.
    • MID Servers verify digital signatures on incoming requests and reject unsigned or tampered data.
    • Rejected requests are logged, and notifications are sent to the protected instance.

    Benefits of Implementing Code Signing

    • Execution Control: Only cryptographically verified scripts run on MID Servers.
    • Tamper Detection: Modifications to signed records are detected and blocked immediately.
    • Automated Protection: Security enforcement is automatic with no manual intervention needed.
    • Comprehensive Logging: All signature verification failures generate detailed audit logs.

    Code Signing Validation and Jobs

    The Code Signing metadata plugin (com.glide.codesigning) signs metadata tables with valid configurations at build time. Admin users with the Security Administrator role can run encryption jobs to manage signing tasks:

    • Sign update sets: Signs records matching a signature configuration in an update set and adds signature records and certificates to the update set.
    • Mass sign records: Signs all records matching a signature configuration on a specified metadata table.
    • Mass sign attachments: Signs all attachments linked to tables with a specified signature configuration.

    These jobs ensure that all relevant data and attachments are cryptographically verified, maintaining data integrity and secure execution on MID Servers.

    Code Signing provides cryptographic verification to ensure that only authorized scripts can execute on MID Servers. Code Signing prevents unauthorized or tampered ECC queue records from being processed by MID Servers, maintaining the integrity of integrations between ServiceNow and external systems.

    Code Signing creates digital signatures for your data, which are later checked to confirm the authenticity and integrity of the data. Code Signing is a module licensed as a component of ServiceNow Vault.

    Note:
    The Customer Service and Support team must grant access to Code Signing.

    Code Signing declares the intent behind the operation being performed and validates whether the resource or record may be used for the intended purpose. To facilitate Code Signing, the Key Management Framework (KMF) uses digital certificates and industry standard asymmetric encryption for digital signatures.

    Use Code Signing internally on the platform and infrastructure side. Code signing provides a way to sign the content of specific tables or of a subset of records in a given metadata table.

    		 Code signing process diagram

    Code Signing uses a secure Circle of Trust (COT) between your trusted and protected instances to ensure that only authorized, secure trusted instances can access the Code Signing feature.

    Note:
    Code Signing is enabled on the protected instance and not on the trusted instance.

    How Code Signing protects your environment

    Without Code Signing, an attacker who gains access to ServiceNow records can modify SQL statements in a protected instance. When the MID Server processes this data source request, it would execute the malicious SQL commands, potentially compromising system integrity and security.

    When you implement a Circle of Trust architecture with Code Signing, transfer of data to the MID Server follows the following verification process. This process helps ensure that only authorized code originating from the trusted instance can execute on the MID Server. The processes reduces potential attack vectors that could otherwise compromise your systems.

    1. Digital signatures are applied to data sources created or updated within the trusted instance.
    2. Use the Code signing process to transfer the signed data from the trusted instance to the protected instance
    3. The MID Server verifies the digital signature on all incoming requests, automatically rejecting any requests lacking valid signatures.
    4. If the MID Server rejects a request, it logs this rejection and sends a notification to the protected instance.

    Benefits of implementing Code Signing

    Code Signing provides several key advantages:

    Execution Control
    Only cryptographically verified scripts can run on MID Servers
    Tamper Detection
    Any modifications to signed records are immediately identified and blocked.
    Automated Protection
    The system handles security enforcement without requiring manual intervention.
    Comprehensive Logging
    All signature verification failures generate detailed audit records.

    Code Signing validation and jobs

    All the metadata tables with valid configurations are signed at build time using the Code Signing metadata plugin​ (com.glide.code_signing). If you choose to sign tables, admin users with the Security Administrator role have access to Code Signing encryption job​s:

    • Sign update sets.
    • Mass sign records.
    • Mass sign attachments.
    Sign update set
    This job signs records that match a signature configuration in the update set. The job also adds all the new signature records and the verification certificates to the update set.
    Figure 1. KMF signature record for update set
    Signature Configuration record for an update set.
    Mass sign records

    This job signs all the records that match the signature configuration applied on a specific metadata table​.

    Mass sign attachments
    This job signs all the attachment records that are attached to a table that matches a specified signature configuration​.
    Figure 2. Encryption job to mass sign records
    Encryption job to mass sign records.