Configuring Code Signing

Activate and configure Code Signing to verify the authenticity and integrity of your data.

Code Signing Enterprise requires an initial trust relationship between trusted and protected instances that helps to prevent any unauthorized user with any authorization level from accessing unapproved activities.

Refer to each topic to complete the configuration steps to establish the Circle of Trust with Code Signing Enterprise:

Assign the Code Signing Administrator Role

Assign the Code Signing Administrator role to a user to access the Code Signing configuration experience.

Configure Code Signing Enterprise on your trusted instance

Turn on Code Signing on your trusted instance.

Upload your Code Signing configuration file to your protected instance

Upload the configuration file generated on your trusted instance.

Configure Code Signing Enterprise on your protected instance

Turn on and configure Code Signing on your protected instance.

Turn on certificate validation

Turn on certificate validation on your instance.

Turn off Code Signing

Disable code signing on your protected instance.

注:

This optional step isn’t part of the initial configuration for Code Signing

• Assign the Code Signing Administrator Role
  Assign the Code Signing Administrator role to a user to access the Code Signing configuration experience.
• Configure Code Signing Enterprise on your trusted instance
  Turn on and configure Code Signing on your trusted instance.
• Upload your Code Signing configuration file to your protected instance
  Upload the configuration file generated on your trusted instance.
• Configure Code Signing Enterprise on your protected instance
  Turn on and configure Code Signing on your protected instance.
• Turn on certificate validation
  Protect your instance with certificate based validation.
• Quorum Controlled Certificate Revocation
  The quorum-controlled certificate revocation for Code Signing certificates provides a secure mechanism for a Code Signing admin to revoke Code Signing certificates. The revocation process involves submitting a request that requires approval from multiple stakeholders. This workflow helps to prevent accidental or unauthorized revocations.
• Turn off Code Signing
  Disable code signing on your protected instance.
• Load required key pairs and certificates for Code Signing
  Establish the relationship in a designated trusted instance using Code Signing. This first step loads two cryptographic keys into the trusted environment to establish a trusted source for updates to the production instance.
• Prepare Circle of Trust certificates
  Create an update set in the trusted environment to export the trusted certificate to the production environment.
• Import and install certificates for Circle of Trust
  Retrieve the update set in production to establish the trust relationship between the two instances. The certificates that have been created to represent trust in the trusted instance must be accepted into the protected instance.
• Turn on Code Signing
  Turn on Code Signing in your trusted non-production instance to identify the trusted instances linking to your production instance.
• Create Code Signing key pairs and certificates
  Create two key pairs to signed certificates to establish trust between your protected and trusted instances.
• Specify custom rules in ECC firewall
  Configure the External Communication Channel (ECC) firewall in your MID Server by specifying the custom rules to selectively allow or reject the incoming message and override the Code Signing configuration.
• Change your Root of Trust configuration
  Trust and use your own certificates instead of relying on ServiceNow build certificates (default) by changing to use your Root of Trust (ROT). ServiceNow components like script includes, business rules, etc., are signed at build time using a ServiceNow build time key (verification certificate is the ServiceNow build certificate).