Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format only - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format only
KB0657111

WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format only


4331 Views Last updated : Apr 7, 2024 public Copy Permalink
KB Summary by Now Assist

Issue

WS-Security profile for Outbound SOAP Secured Web Service needs the "x509 certificate" in PEM format only

Problem

WS-Security profile for Outbound SOAP Secured Web Service allows to create "x509 certificate" in both CER and PEM format.

Symptoms

If a customer creates or update a WS-Security profile for Outbound SOAP Secured Web Service with a "x509 certificate" other than PEM, they could receive the following errors on the system logs or in the localhost:

  • Error signing SOAP envelope: java.io.IOException: Invalid keystore format: sun.security.provider.JavaKeyStore.engineLoad
  • SOAP Msg Outbound - SOAPMessageClient : Error executing SOAP request: Error signing SOAP envelope
  • Unable to extract Key from KeyStore: com.glide.certificates.DBKeyStoreFactory.getPrivateKeyFromKeyStore
Cause

WS-Security assumes the certificate is encoded in PEM format and it could not retrieve it

Resolution

Please perform the following actions to resolve your problem.

To accomplish action A:

  1. Export from the keystore the new certificate used by the secure WS, in PEM format . You will need to know the certificate alias for this operation or
    if you have a cer X509 certificate, you could convert it as follow:
    > openssl x509 -inform der -in certificate.cer -out certificate.pem
  2. Import into ServiceNow the new provided keystore. We recommend in PKCS12 format.
  3. Import into ServiecNow the new x509 certificate in PEM format.
  4. Modify the WS security X509 Outbound profile for this WS call to correctly point to: a) the new keystore record, b) the new certificate record , and c) the certificate alias.

 

Note: WS-Security only allows X509 certificates in PEM format to be used.

 

 


The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.