Set up Certificate-based authentication

Set up mutual authentication for either user interface-based logins or inbound web services.

Before you begin

Role required: sso_config_admin

Check that your instance is using an ADCv2 load balancer. For more information, see theADCv2 Migration knowledge article. If your instance is not using the ADCv2 load balancer, contact Now Support.

Note:

• Certificate Based Authentication is not supported on the On-Prem and edge encryption enabled instance.
• To enable Certificate Based Authentication on self-hosted instance, review this KB article and follow the instructions available in the Native Certificate-Based Authentication row within the table.

.

Procedure

1. Set up Certificate-based authentication to:

   • Allow end users to securely log in to the ServiceNow AI Platform or Service Portal using PIV or CAC cards. After certificate-based authentication is enabled, you can self-register the PEM certificate or an administrator can map the certificate for you. See Log in using Certificate-based authentication.
   • Enable mutual authentication for inbound web services. Once Certificate-based authentication is set up, the system uses the provided certificates to mutually authenticate requests to access ServiceNow REST and SOAP APIs.

Activate Certificate-based authentication

You can activate the Certificate-based authentication plugin (com.glide.auth.mutual) for ServiceNow AI Platform if you have the admin role.

Before you begin

Role required: admin

About this task

The following Tables are installed with Certificate-based authentication:

• sys_user_certificate
• sys_ca_certificate
• sys_ca_certificate_api_track

Procedure

1. Navigate to All > System Applications > All Available Applications > All.

2. Find the Certificate-based authentication plugin (com.glide.auth.mutual) using the filter criteria and search bar.

   You can search for the plugin by its name or ID. If you cannot find a plugin, you might have to request it from ServiceNow personnel.

3. Select Install to start the installation process.

   Note: When domain separation and delegated admin are enabled in an instance, the administrative user must be in the global domain. Otherwise, the following error appears: Application installation is unavailable because another operation is running: Plugin Activation for <plugin name>.

   You will see a message after installation is completed. For information about the components installed with a plugin, see Find components installed with an application.

Register CA certificate

Register root certificates or intermediate certificates to make them available for authentication.

Before you begin

Role required: sso_config_admin

Procedure

1. Navigate to All > Certificate Based Authentication > CA Certificate Chain.

2. Click New.

3. On the form, fill in the fields:

**Note:** During the certificate upload, the read-only fields, **Valid from**, **Expires**, **Expires in days**, **Issuer**, and **Subject**, **Certificate Chain**, and **PEM Certificate** are extracted and auto-populated.

1. Click Submit.

2. Click Validate Stores/Certificates to validate the certificate.

Map PEM certificate to user

Map PEM certificates to users to enable them to log in using PIV or CAC cards or to authenticate inbound requests. You can map multiple PEM certificates to a user.

Before you begin

• Role required: sso_config_admin
• Make sure that you have the Privacy Enhanced Mail (PEM) certificate of the user.

Note: After the Map PEM certificate to User configuration, the "verify certificate" will fail. This is because the PEM certificate is not stored.

Procedure

1. Navigate to All > Certificate Based Authentication > User to Certificate Mapping and click New.

2. On the form, fill in these fields:

**Note:** During the certificate upload, the read-only fields, **Valid from**, **Expires**, **Expires in days**, **Issuer**, and **Subject** are extracted and auto-populated.

1. Click the attachments icon and upload the certificate.

2. Click Submit.

   The certificate is validated and mapped to the specified user if the certificate is from a trusted Certificate Authority (CA).

Configure Certificate-based authentication properties

Use system properties to enable or disable certificate-based authentication features.

Before you begin

Role required: sso_config_admin

Procedure

1. Navigate to All > Certificate Based Authentication > Properties.

2. On the form, fill in the fields: