Knowledge Base

How to use the token/smart card and certificate for signing

Updated on October 1, 2026

Overview

After following this article, you will be able to sign software or documents with the Sectigo certificate stored on your hardware token or smart card, and you will know how to protect the token from permanent lockout or data loss. In this article, "token" means either a hardware token or a smart card. The article covers the prerequisites, four steps (install the SafeNet Authentication Client (SAC), log in to the token, change the token password, and sign), troubleshooting for Windows Remote Desktop and locked tokens, and important limitations of certificates stored on a token. The token password is the password that Sectigo sends you in a separate encrypted token password email; it is the user password for the token, not an administrator password.

Before you start

You will need:

The SafeNet Authentication Client (SAC) installed — download and install it

Your token or smart card, inserted directly into a USB port on the machine — not through a hub or dock

Your token password, from the encrypted email with the subject Sectigo Token Password — Order [your order number]

Permission to install software on the machine, if SAC is not already there

Can't find the password email? It is encrypted and sent separately from your shipping notification. See [I can't find my token password email]. If you have found it but cannot open it, see [How to open your encrypted token password email].

Step 1 — Install the SafeNet Authentication Client

Download SAC from the Sectigo knowledge base and install it following the instructions provided. SAC is what lets Windows and macOS see the certificate on the token and offer it to your signing application.

Step 2 — Insert the token and log in

Insert the token, open the SafeNet Authentication Client, and enter your token password when prompted.

⚠️ The password Sectigo sends you is NOT an administrator password. It is the user password for the token. If a prompt asks for an administrator password, close it — you do not have one and you do not need one.

Five incorrect user password attempts lock the token. This is recoverable: contact Sectigo Support to unlock it.

Five incorrect attempts at the administrator prompt lock the token permanently. There is no recovery. The certificate is lost and a new one must be ordered on new hardware, at additional cost including shipping.

Step 3 — Change the password immediately

In SAC, choose Change Token Password. Enter the issued password as the current password, then set your own.

The password Sectigo sends is a one-time issuance credential. It travelled by email and Sectigo does not retain it after issuance. Once you have changed it, delete or securely archive the issuance email — it no longer has any value. Store your new password in your organization's password manager, recorded against the token serial and order number. See Token Password Best Practices | Sectigo® Official

Step 4 — Sign

With the token inserted and SAC running, the certificate is available to your signing application — Adobe Acrobat, signtool, jarsigner, or whatever your workflow uses. Select the certificate when prompted and enter your token password to authorise the signature.

Remote Desktop does not work

Windows Remote Desktop (RDP) does not pass certificates stored on USB tokens through to the remote session. If you are signing on a remote machine, either sign locally instead, or use a remote access method that supports USB redirection. See Troubleshoot a SafeNet USB token not detected on Windows.

Important limitations

Once a certificate has been provisioned on a token or smart card, it cannot be altered or changed in any way. That is a property of the hardware protection, not a Sectigo restriction.

⚠️ Never re-initialize the token. Re-initializing — also called formatting or initializing — permanently erases the certificate and the private key. The key cannot be exported or backed up, so there is nothing to restore. A new certificate must be ordered on new hardware, at cost including shipping. If a forum post or a troubleshooting tool suggests re-initializing, stop and open a support ticket instead.

If you are locked out of your token, log a ticket and we will help. To revoke a certificate, see revocation.