Knowledge Base

Overview

Use this article to identify which hardware scenario applies to your order and what to confirm before purchasing, renewing or replacing a code signing certificate.

Sectigo-provisioned tokens

The Sectigo-provisioned token process described here supplies the new certificate on a new secure hardware token, also called a smart card.

The private key is generated and stored on the token during issuance. After validation is complete, the token is shipped to the validated organization’s address.

Before purchasing: Contact Support | Sectigo® Official  to confirm whether your specific order requires a new token or offers a supported option for your existing device. Do not assume that a token supplied with a previous order can be reused.

After delivery: Follow the accompanying setup and software instructions before signing code. Receiving the token does not, by itself, confirm that your signing environment is configured.

Expected outcome: You know which token applies to the new order and which setup instructions to follow.

Customer-managed Hardware Security Modules (HSMs)

A Hardware Security Module (HSM) securely generates and stores cryptographic keys. In a customer-managed deployment, your organization manages the signing hardware or service.

Before enrollment, confirm that Sectigo supports your exact configuration and that it meets the requirements for the selected certificate order.

The general process described here is:

• Generate the key pair within the supported hardware, keeping the private key within its secure boundary.
• Prepare a Certificate Signing Request (CSR) and the required key attestation.
• Submit the request and attestation for validation and issuance.
• After issuance, associate the certificate with its corresponding private key using the approved installation instructions.

Key attestation provides evidence about the key’s generation or storage. Confirm the accepted attestation format and submission process before proceeding.

Expected outcome: Your hardware configuration and enrollment approach are confirmed before you submit the request.

Renewals and replacements on customer-managed hardware

Reusing a Hardware Security Module (HSM) and reusing a private key are separate decisions. Eligibility depends on the requirements applicable to the new order.

Before renewing or replacing a certificate, confirm:

• Whether the existing hardware remains supported.
• Whether a new key pair is required.
• Whether new or updated key attestation is required.
• Which enrollment and installation instructions apply.

Do not assume that previously accepted hardware, keys or attestation will automatically be accepted for another issuance.

Expected outcome: You have confirmed the hardware, key and attestation requirements for the renewal or replacement.

What does a three-year term mean?

If your order refers to “three years,” check what that term covers. An order or subscription term and an individual certificate’s validity period are different concepts.

Do not infer certificate validity or token-reuse eligibility from the three-year wording alone.

Ask Sectigo Support to confirm:

• What the three-year term covers.
• The validity period of each issued certificate.
• Any issuance or renewal arrangements included in the order.
• Whether those arrangements require new hardware.

Information to provide when contacting Support | Sectigo® Official 

Have the following information ready:

• Order reference, if available.
• Existing device model or customer-managed service configuration.
• Whether Sectigo supplied the device.
• Whether you are purchasing, renewing or replacing a certificate.
• The order wording you need clarified.

Ask Support to confirm the supported hardware option, enrollment requirements and applicable setup instructions.

Do not send private keys, token passwords.