--- sourceDocument: Brazil ServiceNow AI Platform Capabilities sourceDocumentLink: https://www.servicenow.com/docs/r/servicenow-platform Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # MID Server authentication methods comparison # MID Server authentication methods comparison {#ariaid-title1} Release version: Brazil Updated October 29, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read The MID Server can authenticate to your instance using basic authentication, mTLS, or IPKI methods. The methods differ in what the MID Server presents, who issues and manages the certificate, and how access is revoked. A MID Server can authenticate to its instance in one of three ways. All three identify the MID Server to the instance. They differ in the credential the MID Server presents and in who issues and manages it. * Basic authentication: the MID Server sends a user name and password. * mTLS (mutual authentication): the MID Server presents a client certificate that you obtain from your own certificate authority (CA). The instance and the MID Server authenticate each other during the TLS handshake. * IPKI (instance PKI): the instance issues a certificate to the MID Server. The MID Server uses that certificate's private key to sign a JSON Web Token (JWT) that it sends with each request. IPKI authenticates the MID Server to the instance. It doesn't change the service account that runs the MID Server process, and it doesn't affect Active Directory or LDAP accounts. ## Differences at a glance {#mid-server-authentication-comparison__mid-server-authentication-comparison-table} {#mid-server-authentication-comparison__table-mid-authentication-comparison__entry__4} | Characteristic | Basic authentication | mTLS | IPKI | |-|-|-|-| | Requirements and limits | No certificates to manage. | The instance must use ADCv2 load balancers. A MID Server that uses mutual authentication can't be re-keyed or validated from the instance UI. | Certificates must be valid. An IPKI enabled MID Server with an expired or invalid certificate fails to authenticate until you fix the certificate or reregister the MID Server. | | Who issues the credential | You create the user and set the password. | Your certificate authority. Commercially signed certificates and certificates signed by a private CA are supported. Self-signed certificates aren't supported. | Your instance. | | MID Server user account | You create a user for the MID Server and set its password. | The MID Server needs a user with the mid_server role on the instance. You must map the client certificate to that user on the instance. | The MID Server needs a user with the mid_server role on the instance. When you create a registration key, you map it to a user, and the MID Server logs in as that user. A migrated MID Server keeps its existing user. | | How you set it up | Set the user name and password for the MID Server. | See [Enable MID Server mutual authentication](https://www.servicenow.com/docs/lW8fW_WjxbvJ40wq7z3~GA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration."). | See [Set up a MID Server to use IPKI authentication](https://www.servicenow.com/docs/X9SbJFcCbQxD8QNyPyEyOw "Set up a new MID Server to authenticate to your instance with instance PKI (IPKI), where the instance issues the certificate that the MID Server uses. Use this procedure for a new MID Server."). | | Per MID Server setting | The mid.instance.username and mid.instance.password parameters. | The mid.instance.username parameter is removed when mutual authentication is set up. | The mid.ipki.enabled parameter is set to `true`. The username and password are removed from config.xml. See, [MID Server IPKI reference](https://www.servicenow.com/docs/4x4JfObRRqJMltqGYIhTew "Learn about configuration parameters, keystore aliases, instance-side tables, and log messages for MID Server IPKI authentication.") | | Where the credential is stored | The user name and password in config.xml, or in the keystore. | The key and certificate are in the MID Server keystore. The instance stores the CA chain in \[sys_ca_certificate\] and the client certificate in \[sys_user_certificate\]. | The keypair is in the agent keystore. The instance stores the issued certificates in \[sys_kmf_certificate\]. | | What the MID Server presents | A user name and password. | A client certificate during the TLS handshake. | A JWT, signed with the private key of its certificate, sent as a bearer token in the Authorization header. | | Certificate renewal and rotation | Not applicable. | You obtain and install a new certificate. | The MID Server requests a new certificate before the current one expires. Certificates are valid for 60 days, and rotation starts 15 days before expiration by default. To change this, set the mid.ipki.rotation_trigger_threshold parameter to a value from 8 to 59 days. You can rotate a certificate on demand by forcing rotation. | | Revocation | Change or disable the user or password. | Controlled by your CA. The instance must be able to reach the OCSP and CRL endpoints of the certificate for revocation checks. | The instance tracks certificate activation and revocation continuously. A revoked MID Server is rejected even if its signature is still valid. | [Table 1. Basic authentication, mTLS, and IPKI compared] {#mid-server-authentication-comparison__table-mid-authentication-comparison} **Related concepts** * [MID Server certificate check policies](https://www.servicenow.com/docs/kt_UvWhq81MUejjA6BN9Xg "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.") * [MID Server authentication credentials and SOAP requests](https://www.servicenow.com/docs/9wvetsJqs56G~Q~aW0Htdg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.") * [MID Server unified key store](https://www.servicenow.com/docs/IIggrAjdtsLOp00Maw5dVg#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") * [MID Server Azure Key Vault integration](https://www.servicenow.com/docs/M9ieIpTkQhQdg2oNut_JVQ#mid_azure_key_vault_integration "The MID Server supports three authentication methods to retrieve credentials from Azure Key Vault without storing secrets on the instance.") * [MID Server command audit log](https://www.servicenow.com/docs/EMXPRl6CVActj8Gxjhvhsg#mid-audit-log "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to verify there are no anomalies or errors.") * [MID Server FIPS Enforced Mode](https://www.servicenow.com/docs/30QFWCTwwmrY11lS4oxyEA#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.") * [MID Server Governance](https://www.servicenow.com/docs/QrJ47mqH2Xt60PORd8wg5g "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.") * [MID Server IPKI authentication](https://www.servicenow.com/docs/1Kxkyuj3fB7eWGYCbyyAyA "Instance PKI (IPKI) lets a MID Server authenticate to its instance using a JSON Web Token (JWT) signed by an instance-issued certificate. Use IPKI when you want to authenticate MID Servers with certificates that the instance issues.") * [MID Server IPKI authentication](https://www.servicenow.com/docs/1Kxkyuj3fB7eWGYCbyyAyA "Instance PKI (IPKI) lets a MID Server authenticate to its instance using a JSON Web Token (JWT) signed by an instance-issued certificate. Use IPKI when you want to authenticate MID Servers with certificates that the instance issues.") **Related tasks** * [Encrypt or decrypt MID Server configuration file values](https://www.servicenow.com/docs/Qxlwv2sniasrS9J61qYxGw "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") * [Enable MID Server mutual authentication](https://www.servicenow.com/docs/lW8fW_WjxbvJ40wq7z3~GA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.") * [Rekey a MID Server](https://www.servicenow.com/docs/qZQ2XBnDjEoIwy6~F0zOQA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.") * [Add SSL certificates for the MID Server](https://www.servicenow.com/docs/QOsQFUZoAYRrFyr2~2UDOg#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.") * [Attach a script file to a file synchronized MID Server](https://www.servicenow.com/docs/zB1jO4DdnnKCNeKatnsLTQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.") * [Enable MID Server mutual authentication](https://www.servicenow.com/docs/lW8fW_WjxbvJ40wq7z3~GA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.") * [Set up a MID Server to use IPKI authentication](https://www.servicenow.com/docs/X9SbJFcCbQxD8QNyPyEyOw "Set up a new MID Server to authenticate to your instance with instance PKI (IPKI), where the instance issues the certificate that the MID Server uses. Use this procedure for a new MID Server.") * [Migrate MID Servers to IPKI](https://www.servicenow.com/docs/_PM83pqQkcin66bmUMg0Vg "Move an existing MID Server that uses basic authentication to ServiceNow certificate-based IPKI authentication. Migrating a MID Server to IPKI preserves the user previously set on that MID Server.") **Related reference** * [MID Server configuration file security](https://www.servicenow.com/docs/Ei3fFdVw4e11enuKd53FDA "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.") * [MID Server SSH cryptographic algorithms](https://www.servicenow.com/docs/Dhad9OhghZGQbkbrb43rXA "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")