How to generate X.509 Certificate in ServiceNow

[Hafeez]

Hi there,

We are currently integrating ServiceNow with Workday using both SOAP Web Services and REST API’s via Basic authentication. However, we are now planning to implement Mutual authentication using X.509 Certificate. 

We have gone through the below posts and following the steps to run specific commands gives ‘Access denied’ error. 

Generate a Server Certificate: https://docs.servicenow.com/bundle/paris-platform-administration/page/administer/general/task/t_GenerateAServerCertificate.html

Mutual Authentication: http://www.john-james-andersen.com/blog/service-now/mutual-authentication-and-servicenow.html

Also would like to specifically know from where we should get X.509 cert, should we need to discuss with security team within an organization?

Request to share the details and best practices around it. Also, more information on Mutual authentication will be helpful as well. 

Thank you in advance!

[Hafeez]

Hi TT,

Trust you are doing good.

Do you have high level steps to implement mutual authentication or steps involved to generate X.509 certificate?

Thank you,

Hafeez

[TT3]

Here is what I have: (sorry for the delay) [ServiceNow = ServiceNow instance owner]

Using SSL APIs in Service-Now instance using 2 Way SSL and Basic Authentication

Initial setup before consuming APIs:

Step 1: ServiceNow will procure a valid CA signed certificate and provide public certificate (in DER format with .cer as file extension) to API Provider.

-- To extract key from pfx

openssl pkcs12 -in ServiceNowsystems_com.pfx -nocerts -out key.pem -nodes

-- To extract certificate from pfx

openssl pkcs12 -in ServiceNowsystems_com.pfx -nokeys -out cert.pem

Step 2:  API Provider will perform the necessary steps to load the public certificate generated in step 1 into ’s trust store.

Step 3: ServiceNow will generate and load Java Keystore containing certificate and private key into the ServiceNow instance.

-- create a PKCS 12 file using the recently created private key and certificate files

openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile cert.pem -out devkeystore.p12

-- create a JKS file from the PKCS 12 file.

keytool -importkeystore -srckeystore devkeystore.p12 -srcstoretype pkcs12 -destkeystore devkeystore.jks -deststoretype JKS

Step 4: ServiceNow will configure Protocol Profile in ServiceNow for Mutual Authentication using the Java Keystore created in Step 3.

Step 5: After setup has been done, ServiceNow will configure and test Outbound REST message using previously created protocol.

Reference:

http://www.john-james-andersen.com/blog/service-now/mutual-authentication-and-servicenow.html

[Hafeez]

Hi TT,

Apologies for not being to reply to you.

Above steps will be definitely helpful to us. Implementation has again been postponed due to decision on providing certificate. So I will keep you posted and accordingly mark the post answered 🙂

Thanks again!