Create a service provider key store for SAML

task australia Updated Sep 10, 2026 1 min read t_CreatingAServiceProviderKeyStore.md

Create a Java key store containing the following items for your instance to sign logout requests.

Before you begin

Role required: sso_config_admin, business_rule_admin, script_include_admin

About this task

Signed server certificate for the instance
Signed CA certificate
Public and private key pair

You may create your own signed certificate with a private certificate authority or purchase one from a public certificate authority.

The following steps illustrate how to generate a new Java Keytool keystore file, create a certificate signing request (CSR), and import certificates. Any root or intermediate certificates need to be imported before importing the primary certificate for your domain. Type these commands in a command line interface.

Note: These instructions are not specific to the platform and require technical knowledge of security certificates to complete. Technical Support cannot assist in creating the certificates.

Procedure

Generate a Java keystore and key pair.

Shell

keytool -genkey -alias mydomain -keyalg RSA -keystore my.keystore

Generate a CSR for an existing Java keystore.

Shell

keytool -certreq -alias mydomain -keystore my.keystore -file mydomain.csr

Import a root or intermediate certificate authority CA certificate to an existing Java keystore.
Shell
```
keytool -import -trustcacerts -alias root -file Thawte.crt -keystore my.keystore
```

Import a signed primary certificate to an existing Java keystore.

Shell

keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore my.keystore

62 lines · 2.3 KB Wrap lines

---
title: Create a service provider key store for SAML
description: Create a Java key store containing the following items for your instance to sign logout requests.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/t\_CreatingAServiceProviderKeyStore.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [\(Optional\) Set keystore properties for signing logout requests for SAML, Service Provider \(SP\) system properties, SAML, Multi-Provider single sign-on \(SSO\), Authentication, Access Management]
---

# Create a service provider key store for SAML

Create a Java key store containing the following items for your instance to sign logout requests.

## Before you begin

Role required: sso\_config\_admin, business\_rule\_admin, script\_include\_admin

## About this task

-   Signed server certificate for the instance
-   Signed CA certificate
-   Public and private key pair

You may create your own signed certificate with a private certificate authority or purchase one from a public certificate authority.

The following steps illustrate how to generate a new Java Keytool keystore file, create a certificate signing request \(CSR\), and import certificates. Any root or intermediate certificates need to be imported before importing the primary certificate for your domain. Type these commands in a command line interface.

**Note:** These instructions are not specific to the platform and require technical knowledge of security certificates to complete. Technical Support cannot assist in creating the certificates.

## Procedure

1.  Generate a Java keystore and key pair.

    ```
    keytool -genkey -alias mydomain -keyalg RSA -keystore my.keystore
    ```

2.  Generate a CSR for an existing Java keystore.

    ```
    keytool -certreq -alias mydomain -keystore my.keystore -file mydomain.csr
    ```

3.  Import a root or intermediate certificate authority CA certificate to an existing Java keystore.

    ```
    keytool -import -trustcacerts -alias root -file Thawte.crt -keystore my.keystore
    ```

4.  Import a signed primary certificate to an existing Java keystore.

    ```
    keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore my.keystore
    ```