{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40503,"path":"platform-security/authentication/create-fips-certificate-for-saml.md","title":"Create self-signed BCFKS keystore for SAML","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create self-signed BCFKS keystore for SAML\n\nGenerate a FIPS 140-2 compliant self-signed BCFKS keystore for use in SAML signing and encryption operations within the Multi-Provider SSO plugin.\n\n## Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\nDo the following:\n\n-   Install Java on your machine and the key tool command-line tool accessible in your terminal \\(or \"command prompt\" if you are running it on a windows machine\\).\n-   Perform the following steps to create a keystore using FIPS-approved cryptographic algorithms \\(such as RSA 2048-bit or higher paired with SHA-256\\) that meets federal security requirements for identity federation and single sign-on implementations.\n\n## Procedure\n\n1.  Download the [FIPS Provider Library](https://www.bouncycastle.org/download/bouncy-castle-java-fips/#latest).\n\n    **Note:**\n\n    Use the latest version `bc-fips-2.1.0.jar`. Make sure you use the most recent version.\n\n2.  Generate the FIPS-compliant keystore and certificate.\n\n    1.  Run the following key tool command to generate a self-signed certificate and keystore.\n\n<table id=\"table_ozs_52s_d3c\"><thead><tr><th>\n\nRunning on Linux/macOS\n\n</th><th>\n\nRunning on Windows:\n\n</th></tr></thead><tbody><tr><td>\n\n```\nkeytool -genkeypair \\\n  -providername BCFIPS \\\n  -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \\\n  -providerpath <path_to_bc-fips-<version>>.jar \\\n  -alias <key_alias> \\\n  -keyalg RSA \\\n  -keysize <key_size> \\\n  -keystore <keystore_name>.bcfks \\\n  -validity <validity> \\\n  -storetype BCFKS \\\n  -storepass <keystore_password>\n```\n\n</td><td>\n\n```\nkeytool -genkeypair ^\n-providername BCFIPS ^\n-providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider ^\n-providerpath <path_to_bc-fips-<version>>.jar ^\n-alias <key_alias> ^\n-keyalg RSA ^\n-keysize <key_size> ^\n-keystore <keystore_name>.bcfks ^\n-validity <validity> ^\n-storetype BCFKS ^\n-storepass <keystore_password>\n```\n\n</td></tr></tbody>\n</table>    2.  Replace placeholders `(<...>)` with appropriate values:\n\n        -   `<path_to_bc-fips-<version>>.jar`: Path to `bc-fips-<version>.jar`\n        -   `<key_alias>`: Alias for the key pair\n        -   `<key_size>`: 2048 or 4096\n        -   `<keystore_name>.bcfks`: Desired file name for the keystore\n        -   `<validity>`: Expiry in days\n        -   `<keystore_password>`: Password for the keystore\n    3.  Follow the prompts to enter additional DN \\(Distinguished Name\\) details for the certificate.\n\n        **Note:** When you are prompted for a password for the key \\(alias\\), press the Enter or Return key to use the same password you used for the keystore. Do not give a different password.\n\n    4.  Securely store the key alias and keystore password.\n\n        Provide these credentials while:\n\n        -   Creating the `sys_certificate` record for this keystore.\n        -   Configuring the SAML Identity Provider to provide the signing key or encryption key alias and password.\n        **Note:** The key password is same as the keystore password specified during creation. Use the same password when configuring signing or encryption for the SAML Identity Provider.\n\n3.  Extract the Certificate Chain.\n\n<table id=\"table_lmx_yfs_d3c\"><thead><tr><th>\n\nRunning on Linux/macOS\n\n</th><th>\n\nRunning on Windows:\n\n</th></tr></thead><tbody><tr><td>\n\n```\nkeytool -exportcert \\\n  -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \\\n  -providerpath <path_to_bc-fips-<version>>.jar \\\n  -storetype BCFKS \\\n  -keystore <keystore_name>.bcfks \\\n  -storepass <keystore_password> \\\n  -alias <key_alias> \\\n  -rfc \\\n  -file <file_name>.cer\n```\n\n</td><td>\n\n```\nkeytool -exportcert ^\n-provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider ^\n-providerpath <path_to_bc-fips-<version>>.jar ^\n-storetype BCFKS ^\n-keystore <keystore_name>.bcfks ^\n-storepass <keystore_password> ^\n-alias <key_alias> ^\n-rfc ^\n-file <file_name>.cer\n```\n\n</td></tr></tbody>\n</table>    Replace placeholders `(<...>)` with appropriate values:\n\n    -   `<path_to_bc-fips-<version>>.jar`: Path to `bc-fips-<version>.jar`\n    -   `<keystore_name>.bcfks`: keystore file name as given in previous step\n    -   `<keystore_password>`: keystore password as given in previous step\n    -   `<key_alias>`: Key alias as given in previous step\n    -   `<file_name>.cer`: Desired file name for the extracted certificate in PEM format\n4.  Create a record on `sys_certificate` table.\n\n    1.  Log in to ServiceNow AI Platform.\n\n    2.  Navigate to **All** &gt; **Multi-Provider SSO** &gt; **Administration** &gt; **x509 Certificate**.\n\n    3.  Click **New** to create a record.\n\n    4.  Select **BCFKS keystore** as Type.\n\n    5.  Attach the generated BCFKS keystore file `(<keystore_name>.bcfks)`.\n\n        **Note:** To configure certificate expiry notification, use **Notify on expiration** and **Groups to notify on expiration**, and set the notification timing using **Warn in days to expire** and **Frequency**.\n\n    6.  Fill in other required fields, including the keystore password provided during keystore creation.\n\n    7.  Click **Validate Stores/Certificates** related link to ensure the keystore is valid.\n\n    8.  Copy the `sys_id` of this record.\n\n\n"}}