--- sourceDocument: Brazil ServiceNow AI Platform Capabilities sourceDocumentLink: https://www.servicenow.com/docs/r/servicenow-platform Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # MID Server IPKI authentication # MID Server IPKI authentication {#ariaid-title1} Release version: Brazil Updated October 29, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read Instance PKI (IPKI) lets a MID Server authenticate to its instance using a JSON Web Token (JWT) signed by an instance-issued certificate. Use IPKI when you want to authenticate MID Servers with certificates that the instance issues. ## How IPKI authentication works {#mid-server-ipki-authentication__mid-server-ipki-authentication-how} The MID Server creates a JWT and signs it with the private key associated with its certificate. It then sends that JWT as a bearer token in the Authorization header of an HTTPS request. The certificate's role is to back the JWT's signature and identify the MID Server.{#mid-server-ipki-authentication__mid-server-ipki-authentication-p-0} When the instance receives a request, it reads the JWT as a bearer token. It resolves the acting user from the token's `sub` claim rather than from the certificate. It then evaluates an IPKI authorization policy for that user through the sn_ipki_auth policy API. A DBListener tracks certificate activation and revocation continuously, so a revoked MID Server is rejected even if its signature is still valid.{#mid-server-ipki-authentication__mid-server-ipki-authentication-p-2} ## Certificate rotation {#mid-server-ipki-authentication__section_zxz_fqn_clc} The MID Server rotates its IPKI certificate automatically, starting 15 days before the certificate expires. After it receives the new certificate, the MID Server restarts. ## Force rotation {#mid-server-ipki-authentication__section_xfc_nqn_clc} By default, MID Servers that use IPKI rotate certificates automatically within the rotation window. To rotate a certificate early, use the force rotation feature in the MID Admin workspace. ## Known limitations {#mid-server-ipki-authentication__mid-server-ipki-authentication-limitations} If the IPKI certificate expires, the MID Server can't authenticate to the instance. As a result, it can't rotate the certificate automatically. To restore authentication, fix the certificate or reregister the MID Server. For the steps, see [Reregister MID Servers to restore IPKI authentication](https://www.servicenow.com/docs/DpEsxsyfl1SOS_c2nOJjXg "Generate a registration key and use it to get a new IPKI certificate for an existing MID Server.").{#mid-server-ipki-authentication__mid-server-ipki-authentication-p-11} If automatic rotation fails, the MID Server raises the `Mid-CertificateRotationRequired` issue when the certificate has 7 days or less before it expires. Before the certificate expires, force a rotation or reregister the MID Server. For the messages that the MID Server logs, see [MID Server IPKI reference](https://www.servicenow.com/docs/4x4JfObRRqJMltqGYIhTew "Learn about configuration parameters, keystore aliases, instance-side tables, and log messages for MID Server IPKI authentication.").{#mid-server-ipki-authentication__mid-server-ipki-authentication-p-12} ## Next steps {#mid-server-ipki-authentication__mid-server-ipki-authentication-next} To compare IPKI with basic authentication and mTLS, see [MID Server authentication methods comparison](https://www.servicenow.com/docs/PEMk5upii5aIhj3S49hSaQ "The MID Server can authenticate to your instance using basic authentication, mTLS, or IPKI methods. The methods differ in what the MID Server presents, who issues and manages the certificate, and how access is revoked."). To provision a new MID Server with IPKI, see [Set up a MID Server to use IPKI authentication](https://www.servicenow.com/docs/X9SbJFcCbQxD8QNyPyEyOw "Set up a new MID Server to authenticate to your instance with instance PKI (IPKI), where the instance issues the certificate that the MID Server uses. Use this procedure for a new MID Server."). To move an existing MID Server from basic authentication, see [Migrate MID Servers to IPKI](https://www.servicenow.com/docs/_PM83pqQkcin66bmUMg0Vg "Move an existing MID Server that uses basic authentication to ServiceNow certificate-based IPKI authentication. Migrating a MID Server to IPKI preserves the user previously set on that MID Server."). To restore authentication for a MID Server whose certificate has expired or been revoked, see [Reregister MID Servers to restore IPKI authentication](https://www.servicenow.com/docs/DpEsxsyfl1SOS_c2nOJjXg "Generate a registration key and use it to get a new IPKI certificate for an existing MID Server."). To move a MID Server back to basic authentication, see [Revert MID Servers from IPKI to basic authentication](https://www.servicenow.com/docs/gw6CQBy7IKd5PekwNu4YNw "Move a MID Server that uses IPKI authentication back to basic authentication by changing its configuration and restarting the service.").{#mid-server-ipki-authentication__mid-server-ipki-authentication-p-8} * **[Set up a MID Server to use IPKI authentication](https://www.servicenow.com/docs/X9SbJFcCbQxD8QNyPyEyOw)** Set up a new MID Server to authenticate to your instance with instance PKI (IPKI), where the instance issues the certificate that the MID Server uses. Use this procedure for a new MID Server. * **[Reregister MID Servers to restore IPKI authentication](https://www.servicenow.com/docs/DpEsxsyfl1SOS_c2nOJjXg)** Generate a registration key and use it to get a new IPKI certificate for an existing MID Server. * **[Migrate MID Servers to IPKI](https://www.servicenow.com/docs/_PM83pqQkcin66bmUMg0Vg)** Move an existing MID Server that uses basic authentication to ServiceNow certificate-based IPKI authentication. Migrating a MID Server to IPKI preserves the user previously set on that MID Server. * **[Revert MID Servers from IPKI to basic authentication](https://www.servicenow.com/docs/gw6CQBy7IKd5PekwNu4YNw)** Move a MID Server that uses IPKI authentication back to basic authentication by changing its configuration and restarting the service. * **[MID Server IPKI reference](https://www.servicenow.com/docs/4x4JfObRRqJMltqGYIhTew)** Learn about configuration parameters, keystore aliases, instance-side tables, and log messages for MID Server IPKI authentication. **Related concepts** * [MID Server certificate check policies](https://www.servicenow.com/docs/kt_UvWhq81MUejjA6BN9Xg "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.") * [MID Server authentication methods comparison](https://www.servicenow.com/docs/PEMk5upii5aIhj3S49hSaQ "The MID Server can authenticate to your instance using basic authentication, mTLS, or IPKI methods. The methods differ in what the MID Server presents, who issues and manages the certificate, and how access is revoked.") * [MID Server authentication credentials and SOAP requests](https://www.servicenow.com/docs/9wvetsJqs56G~Q~aW0Htdg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.") * [MID Server unified key store](https://www.servicenow.com/docs/IIggrAjdtsLOp00Maw5dVg#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") * [MID Server Azure Key Vault integration](https://www.servicenow.com/docs/M9ieIpTkQhQdg2oNut_JVQ#mid_azure_key_vault_integration "The MID Server supports three authentication methods to retrieve credentials from Azure Key Vault without storing secrets on the instance.") * [MID Server command audit log](https://www.servicenow.com/docs/EMXPRl6CVActj8Gxjhvhsg#mid-audit-log "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to verify there are no anomalies or errors.") * [MID Server FIPS Enforced Mode](https://www.servicenow.com/docs/30QFWCTwwmrY11lS4oxyEA#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.") * [MID Server Governance](https://www.servicenow.com/docs/QrJ47mqH2Xt60PORd8wg5g "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.") **Related tasks** * [Encrypt or decrypt MID Server configuration file values](https://www.servicenow.com/docs/Qxlwv2sniasrS9J61qYxGw "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") * [Enable MID Server mutual authentication](https://www.servicenow.com/docs/lW8fW_WjxbvJ40wq7z3~GA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.") * [Rekey a MID Server](https://www.servicenow.com/docs/qZQ2XBnDjEoIwy6~F0zOQA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.") * [Add SSL certificates for the MID Server](https://www.servicenow.com/docs/QOsQFUZoAYRrFyr2~2UDOg#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.") * [Attach a script file to a file synchronized MID Server](https://www.servicenow.com/docs/zB1jO4DdnnKCNeKatnsLTQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server. Windows Internet Explorer enhanced security blocks downloaded files that it determines are potentially dangerous. However synchronizing the files avoids this security problem.") **Related reference** * [MID Server configuration file security](https://www.servicenow.com/docs/Ei3fFdVw4e11enuKd53FDA "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.") * [MID Server SSH cryptographic algorithms](https://www.servicenow.com/docs/Dhad9OhghZGQbkbrb43rXA "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.")