Overview
In modern enterprise environments, unmanaged SSH keys create severe operational and cybersecurity risks—including credential sprawl, unmonitored administrative access, and orphan keys that survive employee departures. Without centralized oversight, organizations face audit penalties under PCI-DSS 4.0, SOC 2, and NIST SP 800-53.
SSH Management transforms your ServiceNow platform into a centralized control plane for enterprise SSH credential governance. From self-service request through automated approval, target host placement, and proactive revocation, the solution eliminates blind spots without ever storing sensitive private keys in your instance.
Key Business Benefits
- Zero-Storage Security: Private keys, passphrases, and decrypted secrets are never stored on disk or in the ServiceNow database.
- Eliminate Orphan Keys: Automatically revoke and remove authorized keys when employees transition roles or depart the organization.
- Audit-Ready Governance: Instant reporting and attestation workflows satisfy strict PCI-DSS, SOC 2, and ISO 27001 credential requirements.
- No Spoke Licensing Penalties: Built using native platform architecture (RESTMessageV2) with zero Integration Hub spoke subscription dependencies.
Core Capabilities & Features
- Self-Service Key & Certificate Catalog: Standardized catalog items for requesting new key pairs, OpenSSH signed certificates, renewals, and emergency access.
- Dual-Engine Architecture: Full support for both traditional SSH public key pairs and modern, short-lived OpenSSH certificates for zero-footprint host administration.
- Vendor-Agnostic Vault/CA Router: Scripted extension point architecture supporting native integration with HashiCorp Vault, CyberArk PAM, AWS Secrets Manager, and enterprise CAs.
- ITSM Change Gate Integration: Automatically trigger and enforce Change Requests (CHG) for critical infrastructure and production server key rotations.
- Automated Host Placement: Automate the injection and removal of public keys in target ~/.ssh/authorized_keys files via MID Server or Ansible AWX.
- Proactive Expiration Scanner: Daily automated scanner identifies approaching key expirations and triggers 30, 14, and 7-day proactive renewal notifications.
- Emergency Break-Glass Provisioning: Rapid 4-hour time-to-live (TTL) emergency access linked to P1 incidents with automated revocation upon incident resolution.
Installation & Approval Process
Click Request App above to initiate access. Once approved by our team, you will receive activation confirmation along with the full Installation and Configuration Guide to configure your credential vaults and MID Server placement workflows.
-
Complete SSH Key & Certificate Lifecycle Management: End-to-end orchestration for requesting, generating, deploying, auto-rotating, and revoking SSH key pairs and OpenSSH certificates from a unified ServiceNow interface.
-
Dual-Engine Architecture (Keys & Certificates): Native support for both traditional asymmetric cryptographic key pairs (Ed25519, RSA, ECDSA) and modern zero-trust, short-lived OpenSSH Certificates backed by trusted Certificate Authorities (CAs).
-
Vendor-Agnostic Vault & CA Integration Layer: Out-of-the-box extensible framework with Scripted Extension Points to integrate seamlessly with enterprise secret vaults and CAs—including HashiCorp Vault, CyberArk PAM, AWS Secrets Manager, Thales Luna HSM, Teleport, or custom internal APIs.
-
Zero-Storage Security Architecture: Strict adherence to least-privilege security principles: private keys and passphrases are never stored in the ServiceNow database. ServiceNow securely stores only public keys, fingerprints, and vault reference pointers.
-
Native CMDB Two-Layer Alignment: Full 1:1 bi-directional linkage with ServiceNow’s native cmdb_ci_ssh_key configuration item table for dependency mapping, impact analysis, and estate inventory without altering out-of-the-box CMDB schemas.
-
Automated Identity & Lifecycle Governance: Automated key revocation on employee offboarding or role change, multi-tier approval workflows powered by Decision Builder and Flow Designer, and policy-driven expiration alerts.
-
Change Management (CHG) Guardrails: Built-in ITIL governance ensuring that automated or manual key rotations on critical servers and production environments automatically trigger, validate, and require an approved ServiceNow Change Request.
-
Automated Key Placement & Estate Discovery: Automated deployment of public keys to target host authorized_keys files via MID Server or API orchestration, coupled with discovery scanning to detect orphaned, expired, or untracked legacy SSH keys.
-
Audit Readiness & Real-Time Dashboards: Immutable audit trail logging every lifecycle transaction, access request, rotation event, and revocation, paired with real-time compliance dashboards tracking estate security posture.
Initial release (v1.0.0) of SSH Management:
1.Complete SSH key and certificate lifecycle management (request, generate, place, rotate, and revoke).
2.Multi-provider vault integrations (HashiCorp Vault, CyberArk, AWS Secrets Manager).
3.Automated CI target host placement and CMDB/IRE server reconciliation.
4.Next Experience Workspace and self-service Catalog Items.
5.Role-based security (admin, reviewer, user) with immutable audit logging and full ATF test suite coverage.
-
Required Core ServiceNow Plugins & Components:
- Service Catalog & Request Management: (com.glide.service_catalog) for self-service catalog requests and task fulfillment.
- Configuration Management Database (CMDB): Core CMDB with access to cmdb_ci_ssh_key for CI dependency tracking and asset relationships.
- ITSM Change Management: (com.snc.change_management) required for automated Change Request (CHG) governance during key rotations.
- Flow Designer & Decision Builder: Standard platform workflow engines for approval routing and lifecycle automation.
-
Integration & Licensing Prerequisites:
- No Integration Hub Subscription Required: All outbound integrations are built on ServiceNow's native scoped REST engine (sn_ws.RESTMessageV2), eliminating additional paid spoke or transaction license requirements.
-
MID Server (Required for On-Premises Connectivity & Host Placement):
- When Required: A ServiceNow MID Server is required only if:
- Placing or revoking public keys directly on target Linux/Unix servers (~/.ssh/authorized_keys).
- Connecting to on-premises key vaults or private Certificate Authorities located behind corporate firewalls (e.g., on-prem HashiCorp Vault, CyberArk Enterprise Password Vault, private Step-CA).
- When Not Required: Cloud-to-cloud SaaS integrations (AWS Secrets Manager, HCP Vault, Teleport Cloud) and OpenSSH Certificate issuance operate via direct outbound HTTPS without a MID Server.
- MID Server Network Access: Port 443 (Outbound HTTPS to vault/CA APIs) and Port 22 (SSH placement/stripping to target hosts, if using agentless deployment).
- When Required: A ServiceNow MID Server is required only if: