Configure Customer-supplied keys for Field Encryption Enterprise

---
title: Configure Customer-supplied keys for Field Encryption Enterprise
description: Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/platform-security/fe-config-customer-supplied-keys.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configuring Field Encryption, Field Encryption, Encryption]
---

# Configure Customer-supplied keys for Field Encryption Enterprise

Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.

## Before you begin

Role required: sn\_kmf.admin or sn\_kmf.cryptographic\_manager

## About this task

If you're using Field Encryption Enterprise, you can use your own data encryption key to the platform rather than one generated by ServiceNow.

You must have a symmetric key that has been generated outside of ServiceNow. The examples in this document rely on OpenSSL. For more information on OpenSSL, see details at [https://www.openssl.org](https://www.openssl.org). If you are using other cryptographic tools, such as LibreSSL or GnuTLS, refer to the documentation for those products for similar steps.

## Procedure

1.  In a command line on your machine \(example: Terminal\), run the following command: `openssl rand 32 > mykey.bin`.

    **Note:** When using a 128-bit key, run `openssl rand 16 > mykey.bin` instead of 32.

    Save the `mykey.bin` file, which will be used in following steps.

2.  On your instance, navigate to **All** > **System Security** > **Field Encryption** > **Field Encryption Settings**.

3.  Change the **Key Source** field from **ServiceNow Generated Keys** to **Customer Supplied Keys**.

4.  Select **Submit**.


## What to do next

Use the symmetric key you've created on your instance by following these steps:

1.  [Configure properties for customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/configure-properties-for-customer-supplied-key.md)
2.  [Wrap your customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/wrap-your-customer-supplied-key.md)
3.  

-   **[Configure properties for customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/configure-properties-for-customer-supplied-key.md)**  
Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.
-   **[Wrap your customer-supplied key](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/wrap-your-customer-supplied-key.md)**  
Wrap your symmetric data encryption key with an ephemeral public wrapping key before you can upload it to your instance.

**Parent Topic:**[Configuring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/configuring-column-level-encryption.md)