Knowledge Base

Overview

By the end of this guide, your SafeNet token will be configured with a new password and ready to sign code or documents using your Sectigo certificate. This procedure applies to Organization Validation (OV) and Extended Validation (EV) Code Signing and Document Signing certificates. You will confirm the email that contains your token password, install the SafeNet Authentication Client (SAC), connect your token, and set a new token password.

Prerequisites

• An issued Sectigo certificate order (OV or EV Code Signing, Document Signing, or eIDAS)
• Access to the administrator email mailbox on the order. You must be able to open mail sent to that exact address — the encrypted message is bound to it and cannot be read from a forward or an alias
• The physical SafeNet USB token
• A Windows or macOS machine where you can install software

Steps

Step 1 — Retrieve your token password

Your token password arrives in an encrypted email sent to the administrator address on the certificate order:

• Subject: Sectigo Token Password — Order [your order number]
• From: [email protected]
• Sent: a few minutes before your shipping notification

If it is not in your inbox:

• Search all folders, not just the inbox, for Sectigo Token Password
• Check Junk and Spam
• Ask your IT team to check the mail gateway quarantine — encrypted messages are often held there rather than in your Junk folder, so an empty Junk folder does not mean the message was not delivered

Full steps: I Can’t Find My Token Password Email | Sectigo® Official . To open it: How to Open Your Encrypted Token Password Email from Sectigo | Sectigo® Official 

Your tracking number is in a separate, unencrypted email with the subject Your Sectigo token has shipped — Order [your order number].

Step 2 — Install the SafeNet Authentication Client (SAC)

Download SAC from the Sectigo knowledge base and install it, following the installation instructions provided. You can do this before the token arrives.

Download the SafeNet Authentication Client

Step 3 — Connect the token and open SAC

Insert the USB token directly into a port on the machine — not through a hub or a dock. Then launch the SafeNet Authentication Client from your system menu or applications folder.

Step 4 — Change the token password

• In SAC, select Change Token Password
• Enter the password from your encrypted issuance email as the current password
• Create a new password meeting the requirements shown
• Confirm the new password

                                Figure 1: Screenshot showing "Change Password"
  
     Figure 2: Change Token Password dialog showing the current, new, and confirm password fields.

A confirmation message appears once the token password has been changed. Your token is now ready, and you can sign your file using the new password.

                   Figure 3: Screenshot of "Password changed successfully"

Once you have changed the password, delete or securely archive the issuance email. It no longer has any value and is one more place the old credential exists. Store your new password in your organization's password manager, recorded against the token serial number and order number — see [Token password best practices].

What next

• Start signing: How to use the token, smart card, and certificate for signing 
• Token not detected: Troubleshoot a SafeNet USB token not detected on Windows 

Related articles

• How Sectigo Delivers Your Hardware Token, Tracking Number, and Token Password | Sectigo® Official
• I Can’t Find My Token Password Email | Sectigo® Official
• How to Open Your Encrypted Token Password Email from Sectigo | Sectigo® Official
• Token Password Best Practices | Sectigo® Official
• If Your Token Is Lost, Locked, Re-initialized, or the Certificate Is Deleted | Sectigo® Official

Need help?

If you cannot locate your password email after working through Step 1, open a ticket at Support | Sectigo® Official with your order number and the administrator email address on the order.

• USA: +1 (888) 266-6361
• International: +1 (703) 581-6361