---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Do not use demo certificates for active SAML configurations

# Do not use demo certificates for active SAML configurations {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Control whether demo certificates are used in production SAML configurations.
The demo certificates provided by ServiceNow should not be used in production SAML configurations. The certificates are common among all instances with known passphrase. If one of the SAML properties utilizing a certificate keystore is active
(require_signed_authnrequest, require_signed_logoutrequest, or encrypt_assertion) then the demo data must not be used. Since demo data is shared among all instance,
there is no integrity guarantee of requests signed with shared certificates.

Set up a custom keystore, following the documentation. The value of glide.authenticate.sso.saml2.keystore should be set to the sys_id of a custom, active keystore.

## More information {#sc-do-not-use-demo-certificates-active-saml-configurations-plugin__section_wc1_cqn_phc}

{#sc-do-not-use-demo-certificates-active-saml-configurations-plugin__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.sso.saml2.keystore |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | Does not contain the sys_id <kbd class="ph userinput">c60ad24b732220103a5b0dd43cf6a7db</kbd> or <kbd class="ph userinput">3685fc22930212003c5537ae867ffb91</kbd> |
| Default value | \<none\> |
| Fallback value | \<none\> |
| Category | [Communications](https://www.servicenow.com/docs/Ol4HTvWwwFO1g_KjaK_8RQ "This control ensures proper encryption using strong algorithms and ciphers. This includes ensuring the recommended version of TLS is used for client connectivity, use of strong cipher suites, use of trusted and signed certificates, ensuring connections are encrypted between components and logging of connection failures.") |
| Security risk | * Severity score: 3.9 * CVSS rating: Low * Security risk details: Messages encrypted by the IDP could be decrypted by any actor, if intercepted. {#sc-do-not-use-demo-certificates-active-saml-configurations-plugin__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-do-not-use-demo-certificates-active-saml-configurations-plugin__table_ajc_b43_3kb}