question Re: Expiring codesigning certificate in Developer forum

Expiring codesigning certificate

Community Alums — Tue, 07 Mar 2023 16:13:43 GMT

Greetings everyone. I have a problem that I cannot seem to find a solution for. I have a certificate (code_signing_key_rome_publiccodedesignver) that is expiring soon. We are on San Diego and there is a code_signing_key for SanDiego as well. I am not sure I need to renew the Rome cert. Also, there is no renewal option and it is expiring in both my prod and dev environments. Do I just request a new cert or will it auto renew. I have searched through the community and the docs and can't seem to find anyting on the code signing certs. Theres plenty of info on SSO, LDAP, etc, but nothing about renewing of this certificate. Can anyone assist me with learning this?

Thank you!

Re: Expiring codesigning certificate

chris-ind — Wed, 08 Mar 2023 16:01:18 GMT

I'm getting alerted of the same thing. If no one here knows, I might have to open up a support ticket to ask.

Re: Expiring codesigning certificate

Brian Bouchard — Thu, 09 Mar 2023 14:30:27 GMT

We have the same scenario. Anyone get an official answer yet?

Re: Expiring codesigning certificate

chris-ind — Thu, 09 Mar 2023 15:24:54 GMT

Not yet but I did open a support case just now. I'll post when I find out something.

Re: Expiring codesigning certificate

chris-ind — Thu, 09 Mar 2023 15:52:37 GMT

Below is the response I got back from the ServiceNow Technical Support Engineer. Based on this, I'm just going to disable the notification option on this mentioned certificate so that we don't continue to get notified.

Hello Chris ,

We are placing this issue in Solution Proposed.

Reason: The information provided below should answer the questions presented in this case.

Issue: ServiceNow X.509 Certificate is about to expire

Solution Proposed:

Please be assured the x.509 email is just an awareness notification and the renewal of the SSL certificate is automated by our development team.

This certificate is used in the Key Management Framework (KMF) code signing feature if com.snc.kmf.signature.validation.flag is set to true in the instance:

Some FAQs regarding this certificate and code signing:
1) Why is the 'code_signing_key_rome_publiccodesignver' certificate notification not important and can be ignored?

The "com.snc.kmf.signature.validation.flag" property is marked as false in the instances mentioned, therefore the business has not opted in to use the functionality.

https://YOUR_INSTANCE_HERE.service-now.com/sys_properties_list.do?sysparm_query=nameSTARTSWITHcom.snc.kmf.signature.validation.flag&sysparm_first_row=1&sysparm_view=&sysparm_choice_query_raw=&sysparm_list_header_search=true

2) Why did this notification appear if the business does not use this functionality?

The notification comes from backend logic that applies to all certificates on the instance, whether it is enabled or disabled.

3) How & when would the certificates be renewed if applicable?

The certificates are related to the release, therefore, with each upgrade a new certificate is generated & directly correlates with the version of the instance. For example, if you decides to upgrade to Vancouver, the instance will receive a Vancouver certificate.

4) What is code signing functionality exactly?

This can be explained in :

https://docs.servicenow.com/bundle/tokyo-platform-security/page/administer/encryption/concept/code-signing-concept.html

In summary, You don't need to take any action at this time. The certificate renewal is handled by ServiceNow internally with each version release. Please ignore this expiry notification for it will not impact code signing or validation of signatures.

Next Steps:

Moving your case to Solution Proposed state and Feel free to accept to move this case to the closed state.

Re: Expiring codesigning certificate

nytkod — Mon, 13 Mar 2023 18:17:55 GMT

Received the exact same response from support a few minutes ago.

Re: Expiring codesigning certificate

HugoFirst — Tue, 21 Mar 2023 15:07:20 GMT

We opened a ticket with ServiceNow and got different, conflicting advice. We're following up with a new ticket with a link to this discussion to see if we a matching response.

Re: Expiring codesigning certificate

nytkod — Tue, 21 Mar 2023 15:28:52 GMT

Definitely get a second option. Especially since they are telling us and others this is something that is handled by them internally (which makes perfect sense), and updated each time you upgrade to a new version. The cert we were getting notifications on that was expiring for us is for Rome and we are on San Diego. Our San Diego 509 doesn't expire until later this year. Of course we will be upgrading before that cert expires. What was the response they gave you?

Re: Expiring codesigning certificate

HugoFirst — Tue, 21 Mar 2023 17:37:52 GMT

2 things....

1. Thanks to chris-ind for the helpful post that clarifies the issue for us.

2. The response to our second ticket with ServiceNow is almost word for word identical with the response posted by chris-ind.

Special Note: I checked the setting for the system property "com.snc.kmf.signature.validation.flag" and it is false. So that means that we don't even have the feature that is protected by this cert. So we plan to ignore this one too.

Re: Expiring codesigning certificate

chuckn — Thu, 02 Nov 2023 17:33:49 GMT

Hi all,

Realizing this is an older thread, I've been investigating this same certificate in our environment. We don't have the property set to true, but I've noticed a bunch (eg hundreds a day) of system log errors related to the Signing Keystore (eg "Signing Keystore is empty: no thrown error" and "Signing Keystore is empty: com.snc.platform.security.oauth.jwt.JWTException") that have previously been related to expired certificates. I'm inclined to think that we have to deactivate the code_signing_key_rome_publiccodesignver certificate in order to get those errors to stop. Wondered if anyone of y'all had seen/done the same thing?

Thanks!

-Chuck