---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure mTLS authentication for a MID Web Server

# Configure mTLS authentication for a MID Web Server {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Enhance security in your MID Web Server extension by enabling mTLS
authentication.

## Before you begin

Ensure that you have enabled Transport Layer Security (TLS) on the agent. For details, see [Connect the agent to the MID Server using mTLS](https://www.servicenow.com/docs/9W7wslXzSuhwWoh83s1ctg "Before configuring mTLS authentication on the agent, you must run a series of commands that enable configuring Transport Layer Security (TLS) authentication.").

Ensure that the insecure-skip-tls-verify parameter in the acc.yml configuration file is set to `false`. For details on the acc.yml file, see [Configuration file options](https://www.servicenow.com/docs/_gPlDfn5mF5mSgixcbCHPg "Options available in the acc.yml configuration file.").  
Note:  
This procedure includes commands for both CentOS 7/Linux and Windows Server environments. Select the commands relevant for your host operating system. If working with another Linux distribution, adapt the commands as needed for your specific OS.

Role required: agent_client_collector_admin

## About this task

The MID Web Server extension searches the following locations (in the specified order) to access the truststore location and password:

* Truststore location: The mid.webserver.truststore.path JVM system property.

  If that property is empty, the extension retrieves the location from the javax.net.ssl.trustStore JVM
  system property.

  If no location is specified, the truststore location defaults to the absolute path of the cacerts file of the JRE running the MID Server.
* Truststore password: The Truststore Password field on the extension form in the instance.

  If that field is empty, the system retrieves the password from the
  javax.net.ssl.trustStorePassword JVM system property.

  If no location is specified, the password defaults to changeit.
{#configure-mid-web-server-extension-mTLS__ul_ifd_qf3_nrb}

## Procedure

1. In a Linux environment:
   1. Navigate to the root folder of your MID Server.
   2. Run the following command to add your certificate to the MID trust store:  

          ./jre/bin/keytool -importcert -file /etc/pki/ca-trust/source/anchors/labcacert.pem -destkeystore ./jre/lib/security/cacerts -alias mtlsca

   3. Enter `changeit` when prompted for a password.
   4. Select yes on the confirmation message window to indicate that you trust the certificate.
   5. Run the following command to verify that your certificate was successfully added to the MID trust store:  

          ./jre/bin/keytool -list -keystore ./jre/lib/security/cacerts -alias mtlsca

   6. Enter `changeit` when prompted for a password.
   7. In the MID Server wrapper override configuration file (wrapper-override.conf, located in the conf directory under the MID Server's home directory), configure the revocation of client certificates using the mid.webserver.cert.revocation.check.enabled property.  
      If you have a custom internal certificate, set it to `false` by adding the following line to conf/wrapper-override.conf on the MID Server:

          wrapper.java.additional.4=-Dmid.webserver.cert.revocation.check.enabled=false

      When enabling this property (`true`), configure the mid.webserver.ocsp.responder.url property with the OCSP responder URL. This value overrides any URL embedded in the
      certificate.
   8. If you have changed properties in the wrapper override configuration file, restart the MID Server.
   9. Access the MID Server record on your ServiceNow instance and change the value of the Authentication type field to mTLS.
   10. Restart the MID Web Server.
   11. Verify that the MID Web Server and websocket endpoint are up and running.
   {#configure-mid-web-server-extension-mTLS__substeps_linux_all}
2. In a Windows environment:
   1. Navigate to the root folder of your MID Server.
   2. Run the following command to add your certificate to the MID trust store:  

          jre\bin\keytool.exe -importcert -file <path>\labcacert.pem -destkeystore jre\lib\security\cacerts -alias mtlsca

   3. Enter `changeit` when prompted for a password.
   4. Select yes on the confirmation message window to indicate that you trust the certificate.
   5. Run the following command to verify that your certificate was successfully added to the MID trust store:  

          jre\bin\keytool.exe -list -keystore jre\lib\security\cacerts -alias mtlsca

   6. Enter `changeit` when prompted for a password.
   7. In the MID Server wrapper override configuration file (wrapper-override.conf, located in the conf directory under the MID Server's home directory), configure the revocation of client certificates using the mid.webserver.cert.revocation.check.enabled property.  
      * If you have a custom internal certificate, set it to `false` by adding the following line to conf\\wrapper-override.conf on the MID Server:

            wrapper.java.additional.4=-Dmid.webserver.cert.revocation.check.enabled=false

      * When enabling this property (`true`), configure the mid.webserver.ocsp.responder.url property with the OCSP responder URL. This value overrides any URL embedded in the certificate.
      {#configure-mid-web-server-extension-mTLS__ul_x1t_4fv_bkc}
   8. If you changed properties in the wrapper override configuration file, restart the MID Server using one of the following methods:  
      * Windows Services app
      * Command line using the MID Server's configured service name:

            net stop AgentClientCollector
            net start AgentClientCollector

   9. Access the MID Web Server record on your ServiceNow instance and change the value of the Authentication type field to mTLS.
   10. Restart the MID Web Server.
   11. Verify that the MID Web Server and websocket endpoint are up and running.
   {#configure-mid-web-server-extension-mTLS__substeps_windows_all}

## What to do next

[Connect the agent to the MID Server using mTLS](https://www.servicenow.com/docs/9W7wslXzSuhwWoh83s1ctg "Before configuring mTLS authentication on the agent, you must run a series of commands that enable configuring Transport Layer Security (TLS) authentication.").