Valid but Inactive certificates to be need to be reviewed and deleted/retainedSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } As part of certificate cleanup activities, organizations may identify certificates in the Certificate [sys_certificate] table that are marked as Active = false and not expired. An inactive certificate should not automatically be considered safe for deletion. A certificate may still be referenced by other records or configurations even when it is inactive. Deleting a referenced certificate could result in broken references or errors in the system logs. ServiceNow provides certificate-related tables and functionality for managing certificates and their associated information. This article provides a read-only Background Script that can be used to identify inactive certificates that do not appear to have references and may therefore be candidates for cleanup. Important The script does not delete any certificates. The output should be reviewed before taking any deletion action. It is recommended to test the script in a sub-production instance before running it in production. Background Script Run the following script from: System Definition → Scripts - Background Make sure the script is executed in the Global scope. (function() { var certCount = 0; var referencedCount = 0; var unreferencedCount = 0; var referenceCount = 0; gs.print('============================================================'); gs.print('INACTIVE CERTIFICATE REFERENCE AUDIT'); gs.print('Table: sys_certificate'); gs.print('Mode: READ ONLY - NO RECORDS WILL BE MODIFIED'); gs.print('============================================================'); // Find all reference fields pointing to sys_certificate var dictionary = []; var dict = new GlideRecord('sys_dictionary'); dict.addQuery('internal_type', 'reference'); dict.addQuery('reference', 'sys_certificate'); dict.addQuery('active', true); dict.query(); while (dict.next()) { dictionary.push({ table: dict.getValue('name'), field: dict.getValue('element'), label: dict.getValue('column_label') }); } gs.print('Reference fields discovered: ' + dictionary.length); gs.print(''); // Find inactive certificates var cert = new GlideRecord('sys_certificate'); cert.addQuery('active', false); cert.orderBy('name'); cert.query(); while (cert.next()) { certCount++; var certSysId = cert.getUniqueValue(); var certName = cert.getValue('name') || ''; var certType = cert.getValue('type') || ''; var hasReference = false; var certReferences = 0; gs.print(''); gs.print('------------------------------------------------------------'); gs.print('Certificate #' + certCount); gs.print('Name : ' + certName); gs.print('Sys ID : ' + certSysId); gs.print('Type : ' + certType); gs.print('Active : ' + cert.getValue('active')); // Check every discovered reference field for (var i = 0; i < dictionary.length; i++) { var tableName = dictionary[i].table; var fieldName = dictionary[i].field; var fieldLabel = dictionary[i].label; var refGR = new GlideRecord(tableName); if (!refGR.isValid()) { continue; } refGR.addQuery(fieldName, certSysId); refGR.query(); while (refGR.next()) { hasReference = true; certReferences++; referenceCount++; var displayValue = ''; try { displayValue = refGR.getDisplayValue(); } catch (e) { displayValue = ''; } gs.print( ' REFERENCE FOUND' + ' | Table: ' + tableName + ' | Field: ' + fieldName + ' (' + fieldLabel + ')' + ' | Record: ' + refGR.getUniqueValue() + ' | Display: ' + displayValue ); } } if (hasReference) { referencedCount++; gs.print( 'RESULT: REVIEW - ' + certReferences + ' direct reference(s) found' ); } else { unreferencedCount++; gs.print( 'RESULT: NO DIRECT REFERENCES FOUND' ); } } gs.print(''); gs.print('============================================================'); gs.print('AUDIT SUMMARY'); gs.print('============================================================'); gs.print('Inactive certificates checked : ' + certCount); gs.print('Certificates with references : ' + referencedCount); gs.print('Certificates without references: ' + unreferencedCount); gs.print('Total references found : ' + referenceCount); gs.print('============================================================'); })(); Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Any Instructions<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Recommended Approach Identify certificates where active=false.Determine whether the certificate is referenced by any Reference field.Report certificates with no identified references.Review the results with the appropriate application/security teams.Delete the certificate only after confirming that it is no longer required. ServiceNow reference fields establish relationships between records and their target tables, so checking the dictionary for fields referencing sys_certificate provides a useful generic way to identify dependencies.