Knowledge Base

Knowledge Base SafeNet Authentication Client software

If Your Token Is Lost, Locked, Re-initialized, or the Certificate Is Deleted

Updated on October 1, 2026

Overview

This guidance explains immediate precautions, what to do in each situation, and what information to provide Sectigo Support. Recovery depends on the device, its configuration, and which signing objects remain—not simply whether the private key exists.

Applies to

SafeNet Universal Serial Bus (USB) tokens supplied by Sectigo for Organization Validation (OV) Code Signing, Extended Validation (EV) Code Signing, Document Signing, and applicable electronic identification, authentication and trust services (eIDAS) qualified signature creation device (QSCD) orders.

Before Anything Else: Stop Destructive Troubleshooting

Do not initialize, format, or reinitialize a provisioned token to restore access. Reinitialization can erase the certificate and private key.

If a tool, forum, or colleague suggests initialization, stop and contact Sectigo Support instead.

Stop repeated password attempts and do not enter the user password at an administrator-password prompt.

Do not try guessed administrator credentials or reset procedures without verified, device-specific guidance.

The Token Is Locked

Stop entering passwords and contact Sectigo Support with your order number and token serial number, if available.

Tell Support:

Which operation you were performing.

Whether the prompt requested a user or administrator password.

The error message and approximate number of attempts.

Any reset or initialization actions already taken.

Do not assume a universal attempt limit or guaranteed unblock procedure. Ask Support to assess the model, provisioning, authorization, and available recovery options before proceeding.

You Forgot the User Password

The issuance password was never changed

Check the encrypted issuance email for the original user password.

If the email is unavailable, contact Support for password-delivery assistance.

The password was changed

Check the organization-approved record for the current password, using only access you are authorized to hold.

The issuance email does not contain a password changed afterward.

If the current password cannot be located, contact Support to assess the options; do not assume Support can retrieve it or that a new token is automatically required.

The Token Is Lost or Stolen

Treat a missing token as an urgent security incident.

Contact Sectigo Support immediately and request certificate revocation.

Notify your security team and follow its incident-response process.

Explain whether the password may also have been exposed, including whether it was stored alongside the token.

Ask Support and your security team to assess replacement requirements and possible unauthorized signing.

Do not delay reporting because the token is password-protected.

Ask specialists to assess the implications for existing signatures rather than assuming every signature remains trusted until revocation or becomes invalid afterward.

The Token Is Physically Damaged

Stop using the device and contact Support for assessment.

Do not assume that all physical damage has the same effect on stored credentials or that replacement is automatically the only option.

The Certificate Was Deleted

Deleting a certificate and deleting its private key must be assessed separately.

Do not assume that deleting the public certificate also erased its private key. Ask Support to determine what remains and whether a supported restoration procedure is available.

Do not import files, delete other objects, or initialize the token while attempting to investigate the problem.

The Private Key Was Deleted or the Token Was Re-initialized

A public certificate cannot recreate an erased private key.

For the nonexportable token keys described in the provisioning guidance, there is no exported private-key backup to restore.

Stop further changes and ask Support to confirm which objects remain and what replacement or reissuance process applies.

Do not assume that every incident requires new hardware, a new order, or the same charges.

Replacement and Commercial Arrangements

Contact Sectigo directly for technical assistance, including orders purchased through a reseller.

For replacement quotations, ordering, or invoicing, contact the original seller or account team.

Confirm the applicable hardware, shipping, reissuance, and any revalidation requirements before ordering; the original guidance identifies these as potential commercial considerations.