---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# ACC certificates

# Agent Client Collector certificates {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Agent Client Collector certificates verify the authenticity of your agents, servers, and users. Using Agent Client Collector certificates ensures the safety of your environment.

## Discovering certificates {#acc-certificates__section_k5r_gfl_k3c}

To discover certificates on all of your host's applications with open ports, navigate to AllSystem PropertiesAll Properties and set the sn_acc_vis_content.tls_ssl_scan_all_open_ports property to true.

If you want to maintain certificates only for applications running on specific ports, set this property to false. The property's default value is true.
* **[Manually refresh Agent Client Collector certificates](https://www.servicenow.com/docs/x3DuhrzyaphiXSHYH0M_1w)**   
  Refresh Agent Client Collector self-signed certificates manually to validate Agent Client Collector plugins, instead of waiting for the scheduled synchronization. For example, you can use this feature when the agent can't validate a plugin and you don't want to wait for the scheduled synchronization.
* **[Enable OpenSSL secure signing for plugins](https://www.servicenow.com/docs/pqyFruaU4ghgtqcpx~bDOA)**   
  Create a self-signed certificate for an Agent Client Collector plugin. The following procedure gives an example of how to create an x509 certificate using OpenSSL. For other certificate types, consult OpenSSL documentation.
* **[Add a self-signed certificate to the OS truststore](https://www.servicenow.com/docs/0M3focwhiF~56i0O6Np50A)**   
  Add a self-signed certificate to the truststore of your operating system (OS). By adding a certificate to the truststore, you can verify that the certificate is authentic and that your connections are secure.
* **[Import a self-signed certificate](https://www.servicenow.com/docs/JSzdQHX~1SPGQf1x30uZbw)**   
  Import a self-signed certificate in a Windows system by using the Certificate Import Wizard. The Certificate Import Wizard is required to complete the self-signed certificate import process on a Windows Operating System (OS).
* **[Revoke Agent Client Collector certificates](https://www.servicenow.com/docs/raDHtfuQvezP3ImVp0V_CQ)**   
  Stop communication between the agent and ITOM cloud services by removing an Agent Client Collector certificate. For example, there might be a security breach due to which you want to stop communication by revoking the agent's certificate.
* **[Agent certificate rotation](https://www.servicenow.com/docs/iNZ9ApO0imDUwWjHZt8SqQ)**   
  The Agent Client Collector certificate is valid for two years and must be rotated before it expires to avoid issues with agent connectivity. When expiration is approaching, the agent initiates a certificate rotation request.
* **[Run Certificate Discovery via Agent Client Collector for Visibility Content](https://www.servicenow.com/docs/YVq9o_TaynB~tRgXQbZLKw)**   
  Discover TLS/SSL certificates used by ports running on the agent's server. The Certificate Inventory and Management application uses this information to manage TLS/SSL certificates.

*[\>]: and then