**Overview**

In modern enterprise environments, unmanaged SSH keys create severe operational and cybersecurity risks—including credential sprawl, unmonitored administrative access, and orphan keys that survive employee departures. Without centralized oversight, organizations face audit penalties under  **PCI-DSS 4.0, SOC 2, and NIST SP 800-53**.

**SSH Management**  transforms your ServiceNow platform into a centralized control plane for enterprise SSH credential governance. From self-service request through automated approval, target host placement, and proactive revocation, the solution eliminates blind spots without ever storing sensitive private keys in your instance.

**Key Business Benefits**

- **Zero-Storage Security:**  Private keys, passphrases, and decrypted secrets are never stored on disk or in the ServiceNow database.
- **Eliminate Orphan Keys:**  Automatically revoke and remove authorized keys when employees transition roles or depart the organization.
- **Audit-Ready Governance:**  Instant reporting and attestation workflows satisfy strict PCI-DSS, SOC 2, and ISO 27001 credential requirements.
- **No Spoke Licensing Penalties:**  Built using native platform architecture (RESTMessageV2) with zero Integration Hub spoke subscription dependencies.

**Core Capabilities & Features**

- **Self-Service Key & Certificate Catalog:**  Standardized catalog items for requesting new key pairs, OpenSSH signed certificates, renewals, and emergency access.
- **Dual-Engine Architecture:**  Full support for both traditional SSH public key pairs and modern, short-lived OpenSSH certificates for zero-footprint host administration.
- **Vendor-Agnostic Vault/CA Router:**  Scripted extension point architecture supporting native integration with  **HashiCorp Vault, CyberArk PAM, AWS Secrets Manager** , and enterprise CAs.
- **ITSM Change Gate Integration:**  Automatically trigger and enforce Change Requests (CHG) for critical infrastructure and production server key rotations.
- **Automated Host Placement:**  Automate the injection and removal of public keys in target ~/.ssh/authorized\_keys files via MID Server or Ansible AWX.
- **Proactive Expiration Scanner:**  Daily automated scanner identifies approaching key expirations and triggers 30, 14, and 7-day proactive renewal notifications.
- **Emergency Break-Glass Provisioning:**  Rapid 4-hour time-to-live (TTL) emergency access linked to P1 incidents with automated revocation upon incident resolution.

**Installation & Approval Process**

Click  **Request App**  above to initiate access. Once approved by our team, you will receive activation confirmation along with the full Installation and Configuration Guide to configure your credential vaults and MID Server placement workflows.

1. **Complete SSH Key & Certificate Lifecycle Management:**  End-to-end orchestration for requesting, generating, deploying, auto-rotating, and revoking SSH key pairs and OpenSSH certificates from a unified ServiceNow interface.

2. **Dual-Engine Architecture (Keys & Certificates):** Native support for both traditional asymmetric cryptographic key pairs (Ed25519, RSA, ECDSA) and modern zero-trust, short-lived OpenSSH Certificates backed by trusted Certificate Authorities (CAs).

3. **Vendor-Agnostic Vault & CA Integration Layer:**  Out-of-the-box extensible framework with Scripted Extension Points to integrate seamlessly with enterprise secret vaults and CAs—including HashiCorp Vault, CyberArk PAM, AWS Secrets Manager, Thales Luna HSM, Teleport, or custom internal APIs.

4. **Zero-Storage Security Architecture:**  Strict adherence to least-privilege security principles: private keys and passphrases are never stored in the ServiceNow database. ServiceNow securely stores only public keys, fingerprints, and vault reference pointers.

5. **Native CMDB Two-Layer Alignment:**  Full 1:1 bi-directional linkage with ServiceNow’s native cmdb\_ci\_ssh\_key configuration item table for dependency mapping, impact analysis, and estate inventory without altering out-of-the-box CMDB schemas.

6. **Automated Identity & Lifecycle Governance:**  Automated key revocation on employee offboarding or role change, multi-tier approval workflows powered by Decision Builder and Flow Designer, and policy-driven expiration alerts.

7. **Change Management (CHG) Guardrails:** Built-in ITIL governance ensuring that automated or manual key rotations on critical servers and production environments automatically trigger, validate, and require an approved ServiceNow Change Request.

8. **Automated Key Placement & Estate Discovery:**  Automated deployment of public keys to target host authorized\_keys files via MID Server or API orchestration, coupled with discovery scanning to detect orphaned, expired, or untracked legacy SSH keys.

9. **Audit Readiness & Real-Time Dashboards:**  Immutable audit trail logging every lifecycle transaction, access request, rotation event, and revocation, paired with real-time compliance dashboards tracking estate security posture.