Troubleshooting MID Server keystore certificate expiration warnings - Support and Troubleshooting

Troubleshooting MID Server keystore certificate expiration warnings Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server displays the following warning message:

ATTENTION REQUIRED: Error message for Keystore: security\agent_keystore. Certificate with commonName: 'snc-mid- - ' associated with alias: 'defaultsecuritykeypairhandle' has expired or expiring on: Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } San Diego and higher

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When a MID Server is installed and started, a private keystore (agent\security\agent_keystore) is automatically created. This keystore contains a security certificate that establishes trust between the ServiceNow instance and the MID Server. The certificate encrypts and decrypts sensitive data, such as discovery credentials and encrypted ECC queue payloads.

The default certificate in the keystore uses the alias defaultsecuritykeypairhandle and is set to expire one year from the MID Server restart date. A warning message appears 30 days before expiration.

Each time you restart the MID Server, a new certificate is generated with a one-year expiration date.

If the MID Server has not been restarted for 326 days or more, this expiration warning displays.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Perform one of the following actions:

Option 1: Restart the MID Server (Recommended)

Stop the MID Server service. Restart the MID Server service. Verify the restart by checking the log file: agent\logs\agent0.log.0 Look for a message confirming the new certificate creation with the new expiration date (one year from the restart date). Expected outcome: The warning message clears within 5–10 minutes after restart. The new certificate expires one year from the restart date.

Option 2: Use the ReKey Action (If You Cannot Restart)

If you cannot restart the MID Server for operational reasons:

In the ServiceNow instance, navigate to MID Server > MID Servers list. Select the MID Server requiring the certificate update. Select ReKey from the form actions. Verify the action in the MID Server log file: agent\logs\agent0.log.0 Look for a confirmation message showing the new certificate expiration date. Expected outcome: A new defaultsecuritykeypairhandle is generated. The message in agent\logs\agent0.log.0 displays the new expiration date (one year from the ReKey action date). The warning clears within 5–10 minutes.

Verification Steps After completing either option above:

Check the MID Server status in the MID Servers list. Confirm the status is Up. Review the agent\logs\agent0.log.0 file for confirmation of the new certificate and expiration date. Wait 10 minutes for the warning message to clear from the MID Server instance page. If the warning persists, restart the MID Server a second time. Additional Information Certificate rotation: The MID Server automatically rotates its security certificate annually. This is expected behaviour. Warning timing: The warning appears 30 days before the certificate expires, giving you time to plan the restart or ReKey action. Log file location: Check agent\logs\agent0.log.0 on the MID Server machine (not in the ServiceNow instance) for detailed certificate information