---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Create keys and certificates

# Create keys and certificates {#ariaid-title1}

Release version: Brazil  
Updated November 2, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read  
Create keys and certificates in your root directory to enable Transport Layer Security (TLS) setup. TLS setup is required before you can configure mTLS on the MID Web Server and agent.

## Before you begin

* Ensure that there are no keys installed in the MID unified keystore by running the following command:

      bin/scripts/manage-certificates.(sh/bat) -l

  When there are no keys installed, the output
  is: `defaultsecuritypairhandle`
* Invalidate your MID Server.

  If additional keys exist in the output, reinstall those keys after invalidating the MID Server.
* Ensure that the MID Server is connected to the instance.
* Select a directory in which you want to create certificates, to be called the root directory.
* For Windows environments only: Install [Win32/Win64 OpenSSL](https://slproweb.com/products/Win32OpenSSL.html) with all dependencies and ensure it is on the system `PATH`.
{#create-keys-and-certificates__ul_bsy_hsb_wbc}  
Note:  
This procedure includes commands for both CentOS 7/Linux and Windows Server environments. Select the commands relevant for your host operating system. If working with another Linux distribution, adapt the commands as needed for your specific OS.

Role required: agent_client_collector_admin

## Procedure

1. In a Linux environment:
   1. Create subdirectories for your certificates in your root directory.  

          mkdir -p labca labmid labacc;

   2. Generate the EC key pair.  

          openssl ecparam -list_curves;
          openssl ecparam -out labca/ec-labcakey.pem -name prime256v1 -genkey; 
          ls labca/;

      The generated output is the ec-labcakey.pem file.
   3. Create the root CA certificate.  

          openssl ecparam -in labca/ec-labcakey.pem -text -noout; 
          openssl req -x509 -new -nodes -key labca/ec-labcakey.pem -sha512 -days 365 -out labca/labcacert.pem -subj "/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>"; 
          openssl verify labca/labcacert.pem;

      Generated output:
      * `labca/labcacert.pem: C = <country>, ST = <state>, L = <location>, O = <organization> Lab, OU = <organization unit>, CN = <cn abbreviation>`
      * `OK`
      {#create-keys-and-certificates__ul_tc2_w4j_dcc}
   4. Import the CA certificate into the system trust store.  

          sudo cp -a labca/labcacert.pem /etc/pki/ca-trust/source/anchors/;
          sudo update-ca-trust extract;
          openssl verify labca/labcacert.pem

      Generated output: `labca/labcacert.pem: OK`
   5. Obtain the fully qualified domain name (FQDN) for the host.  

          hostname --all-fqdns;

   6. Generate the server certificate signing request (CSR) and sign it with the CA.  
      Enter the FQDN as the `<hostname>` value in the following commands. If more than one FQDN value is returned, use the value with the following format:
      `hostname.domain.domain.com`.

          openssl req -new -newkey rsa:4096 -keyout labmid/rsa-labmidkey.pem -sha512 -nodes -out labmid/mid.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>";
          openssl x509 -req -days 365 -in labmid/mid.csr -CA labca/labcacert.pem -CAkey labca/ec-labcakey.pem -CAcreateserial -extensions SAN -extfile <(cat /etc/pki/tls/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:<hostname>")) -out labmid/mid.crt;

      Generated output:

          Signature ok
          subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>
          Getting CA Private Key

   7. Combine the key and certificate files into one file, named mid.pem.  

          cat labmid/rsa-labmidkey.pem labmid/mid.crt > labmid/mid.pem;

      If an intermediate certificate authority (CA) signs your MID Web Server certificate, include the complete certificate chain in the mid.pem file. Combine the private key, signed MID Web Server certificate, intermediate CA certificates, and root CA certificate, in that order. If the chain contains multiple intermediate certificates, arrange them from the issuing CA toward the root CA.

      To combine the files when using an intermediate CA, run the following command:

          cat labmid/rsa-labmidkey.pem labmid/mid.crt labmid/intermediate-ca.pem labmid/root-ca.pem > labmid/mid.pem;

      Replace the example certificate filenames and paths with those of your actual certificate chain.
   {#create-keys-and-certificates__substeps_linux_all}
2. In a Windows environment:
   1. Create subdirectories for your certificates in your root directory.  

          mkdir labca labmid labacc

   2. Generate the EC key pair.  

          openssl ecparam -list_curves
          openssl ecparam -out labca\ec-labcakey.pem -name prime256v1 -genkey
          dir labca

      The generated output is the ec-labcakey.pem file.
   3. Create the root CA certificate.  

          openssl ecparam -in labca\ec-labcakey.pem -text -noout
          openssl req -x509 -new -nodes -key labca\ec-labcakey.pem -sha512 -days 365 -out labca\labcacert.pem -subj "/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>"
          openssl verify labca\labcacert.pem

      Generated output: `C=<country>, ST=<state>, L=<location>, O=<organization> Lab, OU=<organization unit>, CN=<cn abbreviation>`
   4. Import the CA certificate into the system trust store.  

          certutil -addstore -f "Root" labca\labcacert.pem
          openssl verify -CAfile labca\labcacert.pem labca\labcacert.pem

      Generated output: `labca/labcacert.pem: OK`
   5. Obtain the fully qualified domain name (FQDN) for the host.  

          net config workstation | findstr /C:<Full Computer name>

      The `Full Computer name` value returned is the FQDN to use as the `<hostname>` later in this procedure.
   6. Create the SAN (Subject Alternative Name) configuration file.  

          copy "%ProgramFiles%\OpenSSL-Win64\bin\cnf\openssl.cnf" openssl-san.cnf
          echo.>>openssl-san.cnf
          echo [SAN]>>openssl-san.cnf
          echo subjectAltName=DNS:<hostname>>>openssl-san.cnf

      Adjust the source `openssl.cnf` path to match your OpenSSL installation location if it differs from the default.
   7. Generate the server certificate signing request (CSR) and sign it with the CA.  
      Enter the FQDN as the `<hostname>` value in the following commands. If more than one FQDN value is returned, use the value with the following format:
      `hostname.domain.domain.com`.

          openssl req -new -newkey rsa:4096 -keyout labmid\rsa-labmidkey.pem -sha512 -nodes -out labmid\mid.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>"
          openssl x509 -req -days 365 -in labmid\mid.csr -CA labca\labcacert.pem -CAkey labca\ec-labcakey.pem -CAcreateserial -extensions SAN -extfile openssl-san.cnf -out labmid\mid.crt

      Generated output:

          Signature ok
          subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>
          Getting CA Private Key

      Note:  
      With OpenSSL 3.x (the Win32/Win64 installer), the `Getting CA Private Key` line may not appear in the output, but `Signature ok` and the correct `subject=` line are still present. To confirm the certificate was signed correctly, verify `labmid\mid.crt` directly:

          openssl x509 -in labmid\mid.crt -noout -subject -dates

      This command shows the subject you specified and valid `notBefore`/`notAfter` dates.
   8. Combine the key and certificate files into one file, named mid.pem.  

          copy /b labmid\rsa-labmidkey.pem+labmid\mid.crt labmid\mid.pem

      If an intermediate certificate authority (CA) signs your MID Web Server certificate, include the complete certificate chain in the mid.pem file. Combine the private key, signed MID Web Server certificate, intermediate CA certificates, and root CA certificate, in that order. If the chain contains multiple intermediate certificates, arrange them from the issuing CA toward the root CA.

      To combine the files when using an intermediate CA, run the following command:

          copy /b labmid\rsa-labmidkey.pem+labmid\mid.crt+labmid\intermediate-ca.pem+labmid\root-ca.pem labmid\mid.pem

      Replace the example certificate filenames and paths with those of your actual certificate chain.
   {#create-keys-and-certificates__substeps_windows_all}

## What to do next

[Set up the MID Web Server with a .pem file](https://www.servicenow.com/docs/s7QW1k_oEpnG6G7LlsFJzQ "Install the .pem file into the MID unified keystore and set up the MID Web Server to enable configuring mTLS on your MID Web Server and agent.").