---
sourceDocument: Brazil Sales Customer Relationship Management
sourceDocumentLink: https://www.servicenow.com/docs/r/order-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Sales Customer Relationship Management

ft:clusterId :

    - omgmt

bundleId :

    - omgmt

workflow :

    - Customer and Industry


---

# Generate JWT certificates

# Generate JWT certificates for ServiceNow Quote Experience {#ariaid-title1}

Release version: Brazil  
Updated October 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Create the security files that the ServiceNow Quote Experience guided setup needs to set up authentication.

## Before you begin

Role required: admin

## About this task

You create these files on your computer by using two command-line tools: `keytool`, which comes with Java, and `openssl`. The files are created in one folder that you choose. Keep the folder and
its files secure.

## Procedure

1. Install Java.
   1. Use one of these options:  
      * Company-approved install: use your company's approved software installation process, such as a software portal or a request to IT.
      * Public download: download the latest LTS version for your operating system from a public site.
   2. Run the installer and accept the default settings.
2. If you use Windows, install OpenSSL.  
   Mac users don't need to take action. OpenSSL is already installed.
   1. Use one of these options:  
      * Company-approved install: use your company's approved software installation process to get OpenSSL.
      * Public download: go to the [OpenSSL binaries page](https://www.openssl.org/community/binaries.html), download the Win64 OpenSSL installer, and run it with the default settings.
      {#quote-exp-jwt-certificates__ul_wjb_wcr_1lc}
   {#quote-exp-jwt-certificates__substeps_vjb_wcr_1lc}
3. Check that Java and OpenSSL work.
   1. Open a terminal window.  
      Use the option for your operating system:
      1. Mac: search for Terminal.
      2. Windows: search for Command Prompt.
      {#quote-exp-jwt-certificates__ol_xjb_wcr_1lc}
   2. Type <kbd class="ph userinput">keytool -help</kbd> and press Enter.  
      A list of options appears. If you see an error, Java isn't installed correctly. Repeat the Java step.
   3. Type <kbd class="ph userinput">openssl version</kbd> and press Enter.  
      A version number appears. If you see an error, OpenSSL isn't installed correctly. Repeat the OpenSSL step.
   {#quote-exp-jwt-certificates__substeps_xjb_wcr_1lc}
4. Create the security key file.
   1. Create a folder for these files, such as ServiceNow Certificates, and open it in your terminal.  
      * Mac: find the folder in Finder, type <kbd class="ph userinput">cd</kbd> with a space in the terminal, drag the folder into the terminal, and press Enter.
      * Windows: open the folder in File Explorer, copy the path from the address bar, type <kbd class="ph userinput">cd</kbd> with a space followed by the path in quotes, and press Enter. For example: `cd
        "C:\Users\jsmith\Documents\ServiceNow Certificates"`
      {#quote-exp-jwt-certificates__ul_zjb_wcr_1lc}
   2. Choose a strong password and record it in a safe place.  
      Note:  
      Check with your internal IT team about password storage guidelines. Your company may require a specific method, such as a password manager. You need this password for the guided setup and to recreate these files later.
   3. Run this command.  
      Replace both instances of <var class="keyword varname">&lt;keystore-password&gt;</var> with your password, and remove the angle brackets.

          keytool -genkey -alias snclient -keyalg RSA -validity 365 -keystore snclient.keystore -storepass <keystore-password> -keypass <keystore-password>

   4. Complete the prompts about the certificate, and confirm your inputs.
   5. Confirm that a file named snclient.keystore is in your folder.
   {#quote-exp-jwt-certificates__substeps_yjb_wcr_1lc}
5. Convert the key file to PKCS12 format.
   1. Run the following command in the same terminal window and folder.  
      Replace both instances of <var class="keyword varname">&lt;keystore-password&gt;</var> with the password you chose.

          keytool -importkeystore -srckeystore snclient.keystore -srcstoretype JKS -destkeystore snclient.p12 -deststoretype PKCS12 -storepass <keystore-password> -deststorepass <keystore-password>

   2. When prompted, enter the password you chose.  
      The terminal doesn't show characters as you type.
   3. Confirm that a file named snclient.p12 is in your folder.  
      If the file is not present, run the previous command again.
   {#quote-exp-jwt-certificates__substeps_akb_wcr_1lc}
6. Extract your private key.
   1. Run this command in the same terminal window and folder.  

          openssl pkcs12 -in snclient.p12 -nocerts -nodes -out private_key.pem

   2. When prompted, enter the password you chose.  
      The terminal doesn't show characters as you type.
   3. Confirm that a file named private_key.pem is in your folder.  
      You open this file in a plain-text editor, such as Notepad on Windows or TextEdit on Mac set to plain text, when you complete the guided setup.
   {#quote-exp-jwt-certificates__substeps_bkb_wcr_1lc}
7. Export your public certificate.
   1. Run this command in the same terminal window and folder.  
      Replace <var class="keyword varname">&lt;keystore-password&gt;</var> with the password you chose.

          keytool -exportcert -alias snclient -keystore snclient.keystore -storepass <keystore-password> -file snclient.cer

   2. Confirm that a file named snclient.cer is in your folder.
   {#quote-exp-jwt-certificates__substeps_ckb_wcr_1lc}
8. Convert the certificate to PEM format.
   1. Run this command in the same terminal window and folder.  

          openssl x509 -inform der -in snclient.cer -out certificate.pem

   2. Confirm that a file named certificate.pem is in your folder.  
      The terminal doesn't print a response.
   {#quote-exp-jwt-certificates__substeps_dkb_wcr_1lc}
9. Copy the certificate contents.
   1. Open certificate.pem in a plain-text editor, such as Notepad on Windows or TextEdit on Mac set to plain text.
   2. Copy the entire contents, including the lines that start with `-----BEGIN` and end with `-----END`.  
      Paste these contents into the Public Certificate field in the Quote Experience guided setup.
   {#quote-exp-jwt-certificates__substeps_ekb_wcr_1lc}
{#quote-exp-jwt-certificates__steps_sjb_wcr_1lc}

## What to do next

Continue with [Set up ServiceNow Quote Experience](https://www.servicenow.com/docs/79Zwh8HdC4VEQ26YyEFx_w "Use the Quote Experience guided setup to connect your ServiceNow instance to your ServiceNow CPQ Microservice instance and set up system-to-system authentication with JWT and OAuth.") to add the certificate and private key to the guided setup.