Resolving Mastercard Certificate Upload Issues in ServiceNow FSO Disputes: 3DES to AES Conversion

[Rahul_Sanghi]

⚠️ Disclaimer: Technical commands and configurations may vary based on your specific environment, ServiceNow release, and Mastercard setup. Always test in a non-production first. This guide evolves with every innovation—bookmark and check back for updates!

Financial institutions implementing ServiceNow Financial Services Operations (FSO) Disputes with Mastercard integration may encounter certificate upload errors when configuring connectivity to Mastercard's dispute resolution platforms (MCOM). This issue typically surfaces during initial setup or when rotating certificates, and stems from encryption standard compatibility between Mastercard-issued certificates and ServiceNow's security framework.

The Problem

When uploading a PKCS#12 (.p12) certificate file obtained from Mastercard Developer Portal into ServiceNow, implementers may see an error during the upload process. The root cause is that Mastercard may provide certificates with private keys encrypted using Triple Data Encryption Standard (3DES), while ServiceNow instances—particularly those created on or upgraded to the Zurich release or later—default to Advanced Encryption Standard (AES) for cryptographic operations.

Why This Matters for FSO Disputes

Mastercard connectivity is critical for:

• Real-time dispute case collaboration via MCOM Collaboration API
• Automated dispute lifecycle management and status synchronization
• Compliance with Mastercard chargeback rules and timelines
• Bi-directional data exchange for representment and arbitration workflows

Without proper certificate authentication, these integrations fail, blocking automated dispute processing and forcing manual workarounds that increase operational risk and processing time.

Background: ServiceNow's Encryption Standards Evolution

Starting with the Zurich release, ServiceNow deprecated 3DES encryption in favor of AES-256, aligning with NIST 800-131A Rev 2 recommendations. ServiceNow deprecated GlideEncrypter usage of 3DES for password2 fields to enhance security and comply with modern cryptographic standards. See Deprecate GlideEncrypter usage of 3DES for password2 fields for details.

This change affects:

• Upgraded instances: GlideEncrypter API defaults to AES; 3DES certificates may trigger warnings or errors
• New Zurich+ instances: 3DES is not supported; AES is required

 

Resolution Options

Option 1: Request AES-Encrypted Certificates from Mastercard (Recommended)

Contact your Mastercard implementation point of contact and request that certificates be issued with AES encryption rather than 3DES. Reference Mastercard's OAuth Key Management documentation and specify:

• PKCS#12 format
• AES-256-CBC encryption for both key and certificate
• Compatibility with NIST 800-131A Rev 2 standards

This is the cleanest long-term solution and eliminates conversion overhead during certificate rotation.

Option 2: Convert 3DES Certificates to AES Using OpenSSL

If you've already received a 3DES-encrypted certificate or need an immediate workaround, you can re-encrypt the PKCS#12 file locally using OpenSSL.

Step 1: Retrieve the alias from the keystore

ServiceNow requires the certificate alias when configuring the connection. Use Java's keytool to extract it from the original certificate:

keytool -list -v -storetype PKCS12 -keystore [original-certificate].p12

Note the alias value from the output—you'll need this when creating the Certificate record in ServiceNow.

Step 2: Extract the certificate and key to PEM format

openssl pkcs12 -in [original-certificate].p12 -nodes -out [original-certificate].pem -passin pass:[your_password]

This decrypts the PKCS#12 file and exports the certificate and private key in unencrypted PEM format.

Step 3: Re-encrypt as PKCS#12 with AES-256-CBC

openssl pkcs12 -export -in [original-certificate].pem -out [original-certificate].p12 -keypbe AES-256-CBC -certpbe AES-256-CBC

You'll be prompted to set a new password for the keystore. This overwrites the original P12 file with an AES-encrypted version.

Step 4: Upload to ServiceNow

Navigate to All > System Definition > Certificates and create a new certificate record or locate your existing Mastercard certificate. Upload the AES-encrypted .p12 file from step 2. 

Note: Even if you see warnings during upload, save the certificate record and test connectivity. In most cases, the certificate works despite initial warnings.

For detailed certificate configuration guidance, see Set up Mastercard Spoke.

Step 5: Validate connectivity

Test the connection to Mastercard's environment from your REST Message or Mastercard integration configuration in FSO Disputes. In many cases, connectivity works successfully despite initial upload warnings. If connectivity fails after troubleshooting, raise a support ticket with ServiceNow Technical Support.

💬 Join the Conversation

Have you encountered Mastercard certificate upload issues in your FSO Disputes implementation? What solutions or workarounds have worked in your environment? Share your experience, alternative approaches, or questions below to help the community!