---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure and upload your customer supplied key

# Configure and upload your customer supplied key {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

You can use your own customer-supplied key instead of using the ServiceNow® system-generated keys.

## Before you begin

Roles required: security_admin, sn_kmf.cryptographic_manager

If you're NOT supplying your own keys, you don't need to perform this procedure. To create a cryptographic module with ServiceNow® keys, go to [Create a cryptographic module](https://www.servicenow.com/docs/_B5LQoO30fa~baK20wx4ig "Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.") or [Create cryptographic module for Field Encryption](https://www.servicenow.com/docs/iWpnIVjpLCG5kUySh2KHfg "Create a Column Level Encryption cryptographic module to define the mechanisms used for cryptographic operations.").  
Note:  
This procedure only applies to Column Level Encryption Enterprise functionality. See [Activate Field Encryption Enterprise](https://www.servicenow.com/docs/r1Uk~z~P3egwvOPMHBnbgQ "Activate either Field Encryption Starter or Field Encryption Enterprise.") for more information.  
Important:  
You can't revoke a customer supplied key.

## Procedure

1. Navigate to AllSystem SecurityField Encryption Settings and verify that Customer Supplied Keys is selected.  
   Figure 1. Key source selection
2. Select Submit.
3. Return to System SecurityField Encryption ModulesCreate New.  
   Figure 2. Create new cryptographic module
4. Complete the Cryptographic Module form as follows:  
   {#upload-customer-supplied-key__table_tqb_5rv_rnb__entry__2}

   | Field | Description |
   |-|-|
   | Module Name | Enter a name for the module. |
   | Crypto spec template | The default cryptographic template is selected. |
   | Name | Auto-populates based on the module name and prepends the name with the scope to ensure which application is being applied. In this case, the global scope is applied. |
   | Crypto module lifecycle state | Select Published to activate the crypto module. |
   | Parent crypto module | The parent module column_level_encryption is selected automatically when using customer-supplied keys and encryption modules. |
   [Table 1. Cryptographic Module fields]

   {#upload-customer-supplied-key__table_tqb_5rv_rnb}
5. Select Submit.
6. Select the newly created cryptographic module from the table.  
   In the Crypto Specifications related list, select the auto-generated key alias with the AES 256 CFB algorithm.

   The system populates the Crypto purpose and the Algorithm for Column Level Encryption automatically and jumps to the Key Origin stage.
7. Notice that Upload customer supplied key is the Origin and the Key alias is already populated.  
   Figure 3. Key origin
8. Select Next to move to the Key Creation stage.  
   There are two links:
   * Download wrapping key downloads the key in a zip file containing an import token and a public key certificate, `.PEM` file. Use the import token to verify successful key wrapping according to security specification for the instance. Use the public key certificate `.PEM` file to wrap your customer supplied key securely before uploading it along with the token.
   * Upload customer supplied key opens the file browser to select the token and the encrypted key that you wrapped.
   {#upload-customer-supplied-key__ul_n4v_4pd_snb}
   Figure 4. Key creation upload links
9. Select Download wrapping key to save the token.  
   Save the token to the same destination location as the key is saved on your system. Don't rename the downloaded token.
10. Run the BYOK command on a terminal to wrap the key.  
    For more information, refer to [Wrap your customer-supplied key](https://www.servicenow.com/docs/S3U~Pz29AXjWdvukQCjOlw "Wrap the symmetric key to use for encryption with the downloaded public key.").
11. Select Upload customer supplied key.
12. Select Browse to select the two files, the wrapped key and the token file.  
    The Attachments window displays the two files.Figure 5. Wrapped key attachments upload Select a file to remove and reupload, if necessary.
13. Select OK.  
    You're returned to the Cryptographic Module screen. A confirmation message displays for a successful upload of the customer key. The key is also listed in the Module Keys related list.  
    Figure 6. Confirmation of key upload

## What to do next

Now that you have finished configuring your cryptographic module with your customer-supplied key, move on to [Create a module access policy](https://www.servicenow.com/docs/nxRVEUO2pFegrVeDnM9X7A "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.")

*[\>]: and then