---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Sign ACC plugin

# Sign and verify an ACC plugin {#ariaid-title1}

Release version: Brazil  
Updated October 23, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Sign an Agent Client Collector (ACC) plugin with a self-signed certificate and verify the signature so that endpoint devices can validate the plugin.

## Before you begin

* The ACC plugin tar.gz file must be created on your local computer.
* OpenSSL must be installed on your local computer.
{#sign-verify-plugin__ul_n12_pc5_n3c}

Role required: admin

## Procedure

1. Generate a 2048-bit RSA key and a corresponding self-signed certificate with one year validity by using the following command:  

       openssl req -nodes -x509 -sha256 -newkey rsa:2048 -keyout "sign.key" -out "sign.crt" -days 365 -subj "/C=IN/ST=TG/L=HYD/O=servicenow/OU=acme/CN=sign"

   This command creates a private key (sign.key) and a public certificate (sign.crt).
2. Sign the plugin file with your private key.  

       openssl dgst -sha256 -sign "sign.key" -out sign.txt.sha256 <var class="keyword varname">plugin name</var>.tar.gz

3. Extract the public key from the certificate for signature verification.  

       openssl x509 -in "sign.crt" -pubkey -noout > pubkey.pem

4. Verify the signature using the public key to confirm the file was signed correctly.  

       openssl dgst -sha256 -verify pubkey.pem -signature sign.txt.sha256 <var class="keyword varname">plugin name</var>.tar.g

5. Encode the signature file using Base64 to enable the ACC agent to validate the plugin.
   * macOS

         base64 -i sign.txt.sha256 -o sign.txt.sha256_encode64.sig

   * Windows

         openssl enc -base64 -in sign.txt.sha256 -out sign.txt.sha256_encode64.sig

   {#sign-verify-plugin__choices_bfj_hl5_n3c}
6. Create a directory to store the signed plugin.  

       mkdir signed-plugin

7. Move the plugin archive and signature file to the new directory.  

       mv <var class="keyword varname">plugin name</var>.tar.gz signed-plugin/

       mv sign.txt.sha256_encode64.sig signed-plugin/

8. Navigate to the new directory.  

       cd signed-plugin

9. Create a tar.gz file containing both the plugin archive and the signature file.  

       tar -C . -zcvf ../sign-test.tar.gz *

10. Copy and place the self-signed certificate (sign.crt) in the certificate directory (\[agent_root\]/cert) of the ACC agent using one of the following options:
    * Copy the file manually.
    * Distribute the certificate to agent devices using a device management utility such as Jamf or Microsoft Intune.
    {#sign-verify-plugin__choices_nwr_yyr_p3c}
11. Add the certificate to the agent trust store.  
    For more information, see [Add a self-signed certificate to the OS truststore](https://www.servicenow.com/docs/No7NxQJBiqQ7c23SOG2m5g "Add a self-signed certificate to the truststore of your operating system (OS). By adding a certificate to the truststore, you can verify that the certificate is authentic and that your connections are secure.").
12. Upload the signed ACC plugin to the ServiceNow instance.  
    For more information, see [Create and edit Agent Client Collector plugins](https://www.servicenow.com/docs/rhuP9UTwtXHmFgSQzfEbIQ "Custom plugins extend Agent Client Collector monitoring capabilities beyond the default plugins. You can create plugins for specific monitoring requirements or modify existing plugins.").