---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set up

# Set up Certificate-based authentication {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Set up mutual authentication for either user interface-based logins or inbound web services.

## Before you begin

Role required: admin

Check that your instance is using an ADCv2 load balancer. For more information, see the[ADCv2 Migration knowledge article](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0952875). If your instance is not using the ADCv2 load balancer, contact Now Support.

## Procedure

Set up Certificate-based authentication in order to:  
* Allow end users to securely log in to the ServiceNow AI Platform or Service Portal using PIV or CAC cards. After certificate-based authentication is enabled, you can self-register the PEM certificate or an administrator can map the certificate for you. See [Log in using Certificate-based authentication](https://www.servicenow.com/docs/uNkoeB~A88U9KwcB2USJgA#ui-login-mutual-auth "After your administrator sets up Certificate-based authentication, you can register the client certificate and log in using your PIV (Personal Identity Verification) or CAC (Common Access Card) card.").
* Enable mutual authentication for inbound web services. Once Certificate-based authentication is set up, the system uses the provided certificates to mutually authenticate requests to access ServiceNow REST and SOAP APIs.
{#set-up-mutual-auth__ul_ing_fh1_nsb}

## Activate Certificate-based authentication {#ariaid-title2}

You can activate the Certificate-based authentication plugin (com.glide.auth.mutual) for ServiceNow AI Platform if you have the admin role. {#activate-certificate-authentication__activate-certificate-authentication-info}

### Before you begin

Role required: admin.

### About this task

The following Tables are installed with Certificate-based authentication:

* sys_user_certificate
* sys_ca_certificate
* sys_ca_certificate_api_track
{#activate-certificate-authentication__ul_qzp_2tx_14b}

### Procedure

1. Navigate to AllSystem ApplicationsAll Available ApplicationsAll. {#activate-certificate-authentication__find-plugins-cmd}
2. Find the Certificate-based authentication plugin (com.glide.auth.mutual) using the filter criteria and search bar.  
   You can search for the plugin by its name or ID. If you cannot find a plugin,
   you might have to request it from ServiceNow
   personnel.{#activate-certificate-authentication__p_cb1_nfg_h1c}
3. Select Install to start the installation process.  
   Note:  
   When domain separation and delegated Admin are enabled in an instance, the administrative user must be in the global domain. Otherwise, the following error appears: Application installation is unavailable because another operation is running: Plugin Activation for \<plugin name\>.
   You will see a message after installation is completed. For information about the components installed with a plugin, see [Find components installed with an application](https://www.servicenow.com/docs/access?context=find-components&version=zurich&pubname=zurich-platform-administration&ft:locale=en-US).
{#activate-certificate-authentication__steps_rzp_2tx_14b}

## Register CA certificate {#ariaid-title3}

Register root certificates or intermediate certificates to make them available for authentication.

### Before you begin

Role required: admin

### Procedure

1. Navigate to AllCertificate Based AuthenticationCA Certificate Chain.
2. Click New.
3. On the form, fill in the fields:  
   {#map-ca-cert-chain__table_att_rwx_c4b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name to identify the certificate. |
   | Expiration notification | Option to warn users when a certificate is about to expire. |
   | Notify on expiration | List of users to be notified when the certificate expires. |
   | Warn in days to expire | Number of days when a notification is sent to users before a certificate expires. |
   | Active | Option to make the client certificate active. |
   | Format | PEM |
   | Type | Type of certificate. Options include: * CA Cert: The root CA certificate. Can also include intermediate certificates in the chain. CA certificates are automatically synced with the load balancer. Use this option when possible to avoid missing a required certificate in the chain. * Intermediate Cert: An intermediate certificate in the certificate chain. This certificate remains on the instance only and is not synced with the load balancer. Only use this option if you need to add an intermediate certificate to an existing chain. {#map-ca-cert-chain__ul_cy3_jvh_dpb} |
   | Short description | Short description of the user client certificate. |
   [Table 1. Mutual Auth CA Certificate form]

   {#map-ca-cert-chain__table_att_rwx_c4b}  
   Note:  
   During the certificate upload, the read-only fields, Valid from, Expires, Expires in days, Issuer, and Subject, Certificate Chain, and PEM Certificate are extracted and auto-populated.
4. Click Submit.
5. **Optional:** Click Validate Stores/Certificates to validate the certificate.

## Map PEM certificate to user {#ariaid-title4}

Map PEM certificates to users to enable them to log in using PIV or CAC cards or to authenticate inbound requests. You can map multiple PEM certificates to a user.

### Before you begin

* Role required: admin
* Make sure that you have the Privacy Enhanced Mail (PEM) certificate of the user.
{#map-user-pem-certificate__ul_qr3_jyy_14b}  
Note:  
After the Map PEM certificate to User configuration, the "verify certificate" will fail. This is because the PEM certificate is not stored.

### Procedure

1. Navigate to AllCertificate Based AuthenticationUser to Certificate Mapping and click New.
2. On the form, fill in these fields:  
   {#map-user-pem-certificate__table_r1h_21z_14b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the user client certificate. |
   | Expiration notification | Option to warn users when a certificate is about to expire. |
   | Warn in days to expire | Number of days when a notification is sent to users before a certificate expires. |
   | Notify on expiration | List of users to be notified when the certificate expires. |
   | Active | Option to make the client certificate active. |
   | User | User who is mapped to the client certificate. The system receives the client certificate from either the inbound request or [certificate registration](https://www.servicenow.com/docs/uNkoeB~A88U9KwcB2USJgA#register-client-cert-pivcac-card "Before you log in to ServiceNow AI Platform using your PIV or CAC card, you must register the client certificate of your PIV or CAC card. If you are not able to register the client certificate, contact your administrator. Your administrator can also register the client certificate of your PIV or CAC card."), and then uses the user designated in this field to initiate a session to execute the request. |
   | Short description | Short description of the user client certificate. |
   | Format | Privacy Enhanced Mail (PEM) format is a base-64 encoded Distinguished Encoding Rules (DER) certificate. |
   | Type | Client cert. This field is read only. |
   [Table 2. User Client Certificate form]

   {#map-user-pem-certificate__table_r1h_21z_14b}  
   Note:  
   During the certificate upload, the read-only fields, Valid from, Expires, Expires in days, Issuer, and Subject are extracted and auto-populated.
3. Click the attachments icon and upload the certificate.
4. Click Submit.  
   The certificate is validated and mapped to the specified user if the certificate is from a trusted Certificate Authority (CA).

## Configure Certificate-based authentication properties {#ariaid-title5}

Use system properties to enable or disable certificate-based authentication features.

### Before you begin

Role required: sso_config_admin

### Procedure

1. Navigate to AllCertificate Based AuthenticationProperties.
2. On the form, fill in the fields:  
   {#configure-certificate-authentication__table_fh4_vb1_b4b__entry__2}

   | Property | Description |
   |-|-|
   | Enable certificate based authentication | Option to enable to Certificate-based authentication for both user interface logins and inbound web services. Default: true Note: On the Portal pages, use the Form Layout to add the field to the form and then enable the property. |
   | Show 'Log in with PIV/CAC' option in login screen | Displays the Log in with PIV/CAC card option on the login screen. Allows users to log in using Certificate-based authentication using the user interface. Default: false |
   | Enable auto-redirect for certificate based login | Determines whether to require that the user click Log in with PIV/CAC card after selecting a registered certificate and entering their PIN. Activate to automatically log in the user after they select a registered client certificate and enter their PIN. Deactivate to require that the user click Log in with PIV/CAC card after they select a registered client certificate and enter their PIN. Default: false |
   [Table 3. Certificate Based Authentication Properties form]

   {#configure-certificate-authentication__table_fh4_vb1_b4b}

*[\>]: and then