---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure Customer-supplied keys for Field Encryption Enterprise

# Configure Customer-supplied keys for Field Encryption Enterprise {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.

## Before you begin

Role required: sn_kmf.admin or sn_kmf.cryptographic_manager

## About this task

If you're using Field Encryption Enterprise, you can use your own data encryption key to the platform rather than one generated by ServiceNow.

You must have a symmetric key that has been generated outside of ServiceNow. The examples in this document rely on OpenSSL. For more information on OpenSSL, see details at <https://www.openssl.org>. If you are using other cryptographic tools, such as LibreSSL or GnuTLS, refer to the documentation for those products for similar steps.

## Procedure

1. In a command line on your machine (example: Terminal), run the following command: `openssl rand 32 > mykey.bin`.  
   Note:  
   When using a 128-bit key, run `openssl rand 16 > mykey.bin` instead of 32.  
   Save the `mykey.bin` file, which will be used in following steps.
2. On your instance, navigate to AllSystem SecurityField EncryptionField Encryption Settings.
3. Change the Key Source field from ServiceNow Generated Keys to Customer Supplied Keys.
4. Select Submit.

## What to do next

Use the symmetric key you've created on your instance by following these steps:

1. [Configure properties for customer-supplied key](https://www.servicenow.com/docs/9eKuv8Wya1mFSHTFgqLG5g "Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.")
2. [Wrap your customer-supplied key](https://www.servicenow.com/docs/PLGQEXQsQeeQKZLLwfixUA "Wrap your symmetric data encryption key with an ephemeral public wrapping key before you can upload it to your instance.")
3. 
{#fe-config-customer-supplied-keys__ol_bm2_pmk_f2c}
* **[Configure properties for customer-supplied key](https://www.servicenow.com/docs/9eKuv8Wya1mFSHTFgqLG5g)**   
  Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.
* **[Wrap your customer-supplied key](https://www.servicenow.com/docs/PLGQEXQsQeeQKZLLwfixUA)**   
  Wrap your symmetric data encryption key with an ephemeral public wrapping key before you can upload it to your instance.

*[\>]: and then