---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Enable OpenSSL secure signing for plugins

# Enable OpenSSL secure signing for plugins {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create a self-signed certificate for an Agent Client Collector plugin. The following procedure gives an example of how to create an x509 certificate using OpenSSL. For other certificate types, consult OpenSSL documentation.

## Before you begin

* Ensure that the verify-plugin-signature property is set to True in the agent's acc.yml file to verify plugin signing.
* Ensure OpenSSL is installed on your system.
{#acc-signing-mechanism__ul_g3w_tsn_llb}Role required: agent_client_collector_admin

## About this task

Enabling an OpenSSL secure signing mechanism for plugins works with an Agent Client Collector installed on a Linux system.

## Procedure

1. Create a plugin file with a tar.gz extension.  
   For more information, see [Create and edit Agent Client Collector plugins](https://www.servicenow.com/docs/IAzYbf446cVMHRYnMDJJwA "You can edit the default plugins, or you can add new plugins, as needed. Creating and editing plugins customizes the Agent Client Collector monitoring capabilities.").
2. Generate your own secure self-certificate for the plugin file.
   1. Create an x509 certificate.  

          openssl req -nodes -x509 -sha256 -newkey rsa:2048 -keyout "sign.key" -out "sign.crt" -days 365 -subj
                  "/C=<CountryName>/ST=<StateOrProvinceName>/L=<Locality>/O=<Organization>/OU=<OrganizationalUnit>/CN=sign"

   2. Sign the plugin file.  

          openssl dgst -sha256 -sign "sign.key" -out sign.txt.sha256 <plugin-name>.tar.gz

      Alternatively, you can sign plugins using a certificate authority. When doing so, assign the certificate .pem format and place it in the agent's cert directory.
   3. Verify that the signature is configured correctly.  

          openssl dgst -sha256 -verify  <(openssl x509 -in "sign.crt" -pubkey -noout) -signature sign.txt.sha256 <plugin-name>.tar.gz

      If the file is valid, the output is Verified OK.
   4. Encode the signature's certificate with base64 coding.  

          base64 sign.txt.sha256 > sign.txt.sha256_encode64.sig

      A sign.txt.sha256_encode64.sig file is created.
   {#acc-signing-mechanism__substeps_fdp_g51_llb} {#acc-signing-mechanism__commands}
{#acc-signing-mechanism__commands}
3. Run the following commands to create a new directory and insert the tar.gz and sign.txt.sha256_encode64.sig files.
   1. `mkdir signed-plugin`
   2. `mv <plugin-name>.tar.gz signed-plugin`
   3. `mv sign.txt.sha256_encode64.sig signed-plugin`
   4. `cd signed-plugin`
   {#acc-signing-mechanism__substeps_lr2_1sy_nxb}
4. Create another tar.gz file by running the same commands as you ran for the first tar.gz file.
   1. `tar -C . -zcvf ../<plugin-name>.tar.gz *`
   2. `cd..`  
      Note:  
      Save the new file as `../<plugin-name>.tar.gz` to avoid naming collisions with the original \<plugin-name\>.tar.gz file that exists in the current directory.
   {#acc-signing-mechanism__substeps_ovx_dvz_vxb}
5. Upload the new tar.gz plugin file to the instance.
6. Set the plugin file as active=true.
7. Place the sign.crt file into one of the following locations:  
   * The Agent Client Collector's cert directory, located in the config folder.
   * On the MID Server, compress the file into a .zip file and place it in the agent/static/cert/customer folder.
   {#acc-signing-mechanism__ul_iws_rrj_fjc}
8. In the acc.yml file, set `verify-plugin-signature` to true.

## What to do next

Add the self-signed sign.crt file to the agent host trust store, as described in [Add a self-signed certificate to the OS truststore](https://www.servicenow.com/docs/PU25UV4dSywKtVBNTKDAlw "Add a self-signed certificate to the truststore of your operating system (OS). By adding a certificate to the truststore, you can verify that the certificate is authentic and that your connections are secure.").