WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format onlyIssue <!-- div.margin{ padding: 10px 40px 40px 30px; } table.tocTable{ border: 1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); padding-top: .6em; padding-bottom: .6em; padding-left: .9em; padding-right: .6em; } table.noteTable{ border:1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); width: 100%; border-spacing:2; } table.internalTable{ border:1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); width: 100%; border-spacing:0; } .sp td{ border-bottom: 1px solid; border-right: 1px solid; border-color:#E0E0E0; background-color: #ffffff; height: 20px; padding-top: .5em; padding-bottom: .5em; padding-left: .5em; padding-right: .5em; } .sphr td{ border-right: 1px solid; border-bottom: 1px solid; border-color:#E0E0E0; background-color: rgb(245, 245, 245); padding-top: .5em; padding-bottom: .5em; padding-left: .5em; padding-right: .5em; height: 20px; } .title { color: #D1232B; font-weight:; font-size:25px; } .hd1{ color: #D1232B; font-weight:; font-size:18px; } .hd2{ color: #646464; font-weight:bold; font-size:16px; } .hd3{ color: #7a7a7a; font-weight:; font-size:16 px; text-decoration:; } .hd4{ color: #000000; font-weight:bold; font-size:14 px; text-decoration:; } td.c4 {vertical-align: middle; text-align: left;} td.c3 {width: 50; vertical-align: middle; text-align: center;} img.c2 {align: baseline;} hr.c1 {border-top-width: 1px; border-top-style: solid; border-top-color: #cccccc;} --> WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format only Problem WS-Security profile for Outbound SOAP Secured Web Service allows to create "x509 certificate" in both CER and PEM format. Symptoms If a customer creates or update a WS-Security profile for Outbound SOAP Secured Web Service with a "x509 certificate" other than PEM, they could receive the following errors on the system logs or in the localhost: Error signing SOAP envelope: java.io.IOException: Invalid keystore format: sun.security.provider.JavaKeyStore.engineLoadSOAP Msg Outbound - SOAPMessageClient : Error executing SOAP request: Error signing SOAP envelopeUnable to extract Key from KeyStore: com.glide.certificates.DBKeyStoreFactory.getPrivateKeyFromKeyStore Cause WS-Security assumes the certificate is encoded in PEM format and it could not retrieve it Resolution Please perform the following actions to resolve your problem. To accomplish action A: Export from the keystore the new certificate used by the secure WS, in PEM format . You will need to know the certificate alias for this operation or if you have a cer X509 certificate, you could convert it as follow:> openssl x509 -inform der -in certificate.cer -out certificate.pemImport into ServiceNow the new provided keystore. We recommend in PKCS12 format.Import into ServiecNow the new x509 certificate in PEM format.Modify the WS security X509 Outbound profile for this WS call to correctly point to: a) the new keystore record, b) the new certificate record , and c) the certificate alias. Note: WS-Security only allows X509 certificates in PEM format to be used.