---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Map PEM certificate to user

# Map PEM certificate to user {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Map Privacy Enhanced Mail (PEM) certificates to users to enable them to log in using personal identity verification (PIV) or Common Access Card (CAC) or to authenticate inbound requests. You can map multiple PEM certificates to a user.

## Before you begin

* Role required: sso_config_admin
* The Privacy Enhanced Mail (PEM) certificate of the user must be available.
{#map-user-pem-certificate__ul_qr3_jyy_14b}  
Note:  
After the Map PEM certificate to User configuration, the "verify certificate" fails. This is because the PEM certificate is not stored.

## Procedure

1. Navigate to AllCertificate Based AuthenticationUser to Certificate Mapping and select New.
2. On the form, fill in these fields:  
   {#map-user-pem-certificate__table_r1h_21z_14b__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the user client certificate. |
   | Expiration notification | Option to warn users when a certificate is about to expire. |
   | Warn in days to expire | Number of days when a notification is sent to users before a certificate expires. |
   | Notify on expiration | List of users to be notified when the certificate expires. |
   | Active | Option to make the client certificate active. |
   | User | User who is mapped to the client certificate. The system receives the client certificate from either the inbound request or [certificate registration](https://www.servicenow.com/docs/XbmLXnheRhRYosgvKzgZNg#register-client-cert-pivcac-card "Before you log in to ServiceNow AI Platform using your PIV or CAC card, you must register the client certificate of your PIV or CAC card. If you are not able to register the client certificate, contact your administrator. Your administrator can also register the client certificate of your PIV or CAC card."), and then uses the user designated in this field to initiate a session to execute the request. |
   | Short description | Short description of the user client certificate. |
   | Format | Privacy Enhanced Mail (PEM) format is a base-64 encoded Distinguished Encoding Rules (DER) certificate. |
   | Type | Client cert. |
   [Table 1. User Client Certificate form]

   {#map-user-pem-certificate__table_r1h_21z_14b}  
   Note:  
   During the certificate upload, the read-only fields, Valid from, Expires, Expires in days, Issuer, and Subject are extracted and auto-populated.
3. Select the attachments icon and upload the certificate.
4. Select Submit.  
   The certificate is validated and mapped to the specified user if the certificate is from a trusted Certificate Authority (CA).

*[\>]: and then