{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40799,"path":"platform-security/change-rot-overview.md","title":"Change your Root of Trust configuration","bundle":null,"doc_type":null,"release":"australia","body":"\n# Change your Root of Trust configuration\n\nTrust and use your own certificates instead of relying on ServiceNow build certificates \\(default\\) by changing to use your Root of Trust \\(ROT\\). ServiceNow components like script includes, business rules, etc., are signed at build time using a ServiceNow build time key \\(verification certificate is the ServiceNow build certificate\\).\n\n## Changing the root of trust\n\nTo change the Root of Trust for these records signatures, you must follow the change of Root of Trust process.\n\n-   Generate and migrate a new set of signatures for all provided components, using your provided certificate.\n-   Disable the Root of Trust property using a scheduled job.\n\nLearn more about these steps in [Migrate signatures to use a customer certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/migrate-sigs-customer-rot.md) and [Disable ServiceNow Root of Trust](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/disable-sn-rot.md).\n\n## Impact on the signature generation and verification process\n\nBy default, Code Signing build certificates are trusted during the signature verification process. After making this change, your instance accepts signatures only from your own Code Signing certificate.\n\n\\[Omitted image \"root-of-trust-1.png\"\\] Alt text: Before and after changing the ROT configuration\n\n<table id=\"table_txw_zd2_pzb\"><thead><tr><th>\n\nROT property set to false \\(default\\)\n\n</th><th>\n\nROT property set to true\n\n</th></tr></thead><tbody><tr><td>\n\n-   When verifying, signatures with build certificates are trusted.\n-   When signing, if you don't provide keys, the instance signing key is used as a backup key.\n-   The signature REST end point **api/sn\\_kmf/signature/certificates** returns ServiceNow Code Signing build certificates along with other certificates present on the instance.\n\n</td><td>\n\n-   When verifying, signatures with build certificates aren’t trusted.\n-   When signing, if you don't provide keys, signing isn’t performed.\n-   The signature REST end point **api/sn\\_kmf/signature/certificates** excludes ServiceNow build certificates \\(San Diego, Vancouver PKI, W PKI\\).\n\n</td></tr></tbody>\n</table>## Impact on your MID Server\n\n-   **When the ROT property is set to false**\n\n    If you choose to leave your ROT property at its default value \\(false\\), there’s no impact on your MID Server.\n\n-   **When Code Signing is enabled and the ROT property is set to true**\n    -   The isTrusted\\(\\) API returns `false` for signatures with a build certificate.\n    -   The isTrusted\\(\\) API returns `true` for signatures with your certificate.\n    -   The REST API call for certificates excludes build certificates.\n    -   You may see MID Server issues, such as `signature validation failed` messages in the logs.\n\n"}}