Deploy the OpenLM ACC signing certificate

ServiceNow Agent Client Collector (ACC) agents run a plugin only after they verify its signature. ACC turns this check (verify-plugin-signature) on by default on Windows, macOS, and Linux. To let your agents run the checks of the OpenLM ACC Plugin, deploy the OpenLM signing certificate once: put it on each MID (Management, Instrumentation, and Discovery) Server, and trust it on each agent host. The same certificate signs the OpenLM checks for all 3 operating systems.

Deploy the certificate before you enroll machines in OpenLM monitoring. The agent checks the signature when it first downloads the OpenLM checks.

Before you begin

You need the following:

• The certificate files from OpenLM: sign.zip and sign.crt, plus trust-acc-signing-cert.sh for macOS and Linux hosts.
• File access to each MID Server that your ACC agents connect through.
• Administrator rights on each agent host: local Administrator on Windows, and root (sudo) on macOS and Linux.
• The ServiceNow role agent_client_collector_admin, to start the certificate sync.
• openssl on macOS and Linux hosts. The trust-acc-signing-cert.sh script uses it. macOS includes it.

Check the certificate

Before you trust the certificate on any host, confirm that its details match these values:

Certificate detail	Value
Subject	CN=sign, OU=ACC, O=OpenLM (self-signed)
SHA-1 fingerprint	B7:63:37:0D:A2:8F:23:1C:C0:ED:17:EF:1B:3F:D8:CE:F1:7E:2E:82
SHA-256 fingerprint	64:0B:44:91:8D:C9:26:70:36:9B:04:40:E1:FC:FA:27:57:F0:7D:1E:CA:16:B2:49:92:D8:23:C7:01:62:BC:1F
Valid until	August 18, 2027

To read the SHA-1 fingerprint of the file you received, run one of these commands in the folder that contains sign.crt:

Windows

(Get-PfxCertificate -FilePath .\sign.crt).Thumbprint

The output has no colons: B763370DA28F231CC0ED17EF1B3FD8CEF17E2E82.

Linux and macOS

openssl x509 -in sign.crt -noout -fingerprint -sha1

If the fingerprint doesn't match, don't trust the file. Ask OpenLM for a new copy.

Place the certificate on each MID Server

Your agents get the certificate from the MID Server they connect through. On every such MID Server:

1. Find the MID Server installation directory.

   On Windows, open Services, open the MID Server service, and read Path to executable. On Linux, it's the directory where you installed the MID Server.

2. Copy sign.zip into the agent\static\cert\ folder of that directory (agent/static/cert/ on a Linux MID Server).

   Keep the file as a .zip. The MID Server ignores an unzipped certificate. You can put it in a subfolder of cert if you prefer.

3. In ServiceNow, open the MID Server record, and under Related Links, select Trigger ACC certificate sync.

   The sync sends the certificate to the agents now. Without it, the agents receive the certificate within about 24 hours.

Trust the certificate on each agent host

Each agent host must also trust the certificate in the trust store of its operating system: Trusted Root on Windows, the CA trust store on Linux, and the System keychain on macOS.

Windows

1. Open PowerShell as an administrator.

2. Import the certificate into the Trusted Root store:

   Import-Certificate -FilePath "<path-to>\sign.crt" -CertStoreLocation Cert:\LocalMachine\Root

3. Confirm that the certificate is in the store:

   Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*CN=sign*" }

Many Windows hosts

Deploy sign.crt to the Trusted Root store of every agent machine centrally, for example with Group Policy or Intune, instead of one host at a time.

Linux

1. Copy sign.crt and trust-acc-signing-cert.sh to the host.

2. Run the script as root:

   sudo bash trust-acc-signing-cert.sh --cert sign.crt --fingerprint B7:63:37:0D:A2:8F:23:1C:C0:ED:17:EF:1B:3F:D8:CE:F1:7E:2E:82 --restart-agent

The script checks the certificate's fingerprint before it trusts the file, and refuses a file that doesn't match (exit code 2). It then adds the certificate to the system trust store and restarts the ACC agent service (acc). The script supports Debian and Ubuntu, Red Hat Enterprise Linux (RHEL)-based distributions (Fedora, CentOS, Rocky Linux, AlmaLinux), and SUSE.

To trust the certificate by hand instead, run the commands for your distribution:

• Debian or Ubuntu:

  sudo cp sign.crt /usr/local/share/ca-certificates/openlm-acc-signing.crt && sudo update-ca-certificates && sudo systemctl restart acc

• RHEL-based distributions:

  sudo cp sign.crt /etc/pki/ca-trust/source/anchors/openlm-acc-signing.crt && sudo update-ca-trust extract && sudo systemctl restart acc

• SUSE:

  sudo cp sign.crt /etc/pki/trust/anchors/openlm-acc-signing.crt && sudo update-ca-certificates && sudo systemctl restart acc

To confirm on Debian or Ubuntu, print the fingerprint of the trusted copy and compare it with the expected value:

openssl x509 -in /etc/ssl/certs/openlm-acc-signing.pem -noout -fingerprint -sha1

Many Linux hosts

Deploy sign.crt with your configuration-management tool instead of one host at a time.

macOS

1. Copy sign.crt and trust-acc-signing-cert.sh to the Mac.

2. In Terminal, run the script as an administrator:

   sudo bash trust-acc-signing-cert.sh --cert sign.crt --fingerprint B7:63:37:0D:A2:8F:23:1C:C0:ED:17:EF:1B:3F:D8:CE:F1:7E:2E:82 --restart-agent

The script checks the certificate's fingerprint before it trusts the file, refuses a file that doesn't match (exit code 2), adds the certificate to the System keychain, and restarts the ACC agent.

To trust the certificate by hand instead:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain sign.crt && sudo launchctl kickstart -k system/com.sn.acc

To confirm, run this command. It prints the fingerprint when the certificate is trusted, and nothing otherwise:

security find-certificate -a -c sign -Z /Library/Keychains/System.keychain | grep B763370DA28F231CC0ED17EF1B3FD8CEF17E2E82

Many Macs

Deploy sign.crt with your mobile device management (MDM) tool instead of one Mac at a time.

Verify

To confirm that your agents trust the OpenLM checks:

1. Wait about a minute for the agents to get the certificate, or restart the ACC agent on a host:

   Operating system	Restart command
   Windows	Restart-Service AgentNow
   Linux	sudo systemctl restart acc
   macOS	sudo launchctl kickstart -k system/com.sn.acc

2. Enroll at least one machine in OpenLM monitoring. See Choose which machines to monitor.

3. On that machine, open the ACC log:

   Operating system	ACC log
   Windows	C:\ProgramData\ServiceNow\agent-client-collector\log\acc.log
   Linux	/var/log/servicenow/agent-client-collector/acc.log
   macOS	/Library/Application Support/servicenow/agent-client-collector/log/acc.log

4. Confirm that the OpenLM checks run. Look for Running check, name: policy: Dynamic_process_monitor_policy on Windows, or policy: Dynamic_process_monitor_policy_mac_linux on macOS and Linux.

5. Confirm that the log has no couldn't verify asset errors, and that the machine shows Healthy in the plugin's Monitored Devices.

note

Depending on its version, the agent either also logs Successfully verified plugin with signature and public key or logs only failures. A missing success line isn't an error.

Troubleshooting

Log message or symptom	Cause and fix
couldn't verify asset or couldn't get signature file full path	The certificate isn't on the MID Server yet. Repeat Place the certificate on each MID Server, including the certificate sync.
x509: certificate signed by unknown authority	The host doesn't trust the certificate. Trust the certificate on that host, and then restart the agent.
The MID Server ignores the certificate.	The file must be a .zip. Zip sign.crt again, and copy the .zip file to the cert folder.
FINGERPRINT MISMATCH from trust-acc-signing-cert.sh (exit code 2)	The file isn't the OpenLM certificate, or it's damaged. Get a new copy from OpenLM. Don't trust the file by hand.
No ACC agent service found or No ACC agent LaunchDaemon (com.sn.acc) found	The script trusted the certificate but couldn't restart the agent. Restart it yourself with the command in Verify.
Unsupported distribution - no known trust anchor directory found	The script doesn't know your Linux distribution. Add sign.crt to the system trust store with your distribution's own tool, and then restart the agent.

Remove the certificate

To stop trusting the OpenLM certificate, for example after you remove the OpenLM ACC Plugin:

1. Remove the certificate from each agent host.

   On Windows, in PowerShell as an administrator:

   Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Thumbprint -eq "B763370DA28F231CC0ED17EF1B3FD8CEF17E2E82" } | Remove-Item

   On macOS and Linux, as root:

   sudo bash trust-acc-signing-cert.sh --remove --fingerprint B7:63:37:0D:A2:8F:23:1C:C0:ED:17:EF:1B:3F:D8:CE:F1:7E:2E:82

2. Delete sign.zip from the agent\static\cert\ folder of each MID Server (agent/static/cert/ on a Linux MID Server).