DigiCert Code Signing on a USB token: installation
This guide covers the whole process from ordering to your first signature with a DigiCert Code Signing certificate on a SafeNet USB token. It walks through validation, driver installation, the DigiCert installation tool, token initialisation and practical signing tips.
The installation code comes from FairSSL, not from CertCentral
DigiCert's own guides tell you to fetch an installation code in DigiCert CertCentral. That does not apply to you: as a FairSSL customer you do not have access to CertCentral. When the certificate is issued, FairSSL automatically sends an email with your one-time installation code and a link to this guide. Everything you need is in that email.
What to expect after ordering
FairSSL creates the order with DigiCert
We submit your order to DigiCert and start the validation process.
DigiCert validates the organisation
The approver on the order is contacted. For EV Code Signing the approver identity is verified as well. Make sure the approver can be reached by phone.
A new USB token is shipped by post
If you ordered a new token, FairSSL ships a SafeNet eToken with PostNord for next-business-day delivery, usually received within 2 working days. If you are renewing onto an existing token, nothing is shipped.
The certificate is issued and FairSSL sends the installation code
Once validation is approved, the certificate is issued and we automatically send an email with the one-time installation code and the steps from this guide.
Step 1: Install SafeNet Authentication Client
SafeNet Authentication Client is the driver that lets your computer talk to the USB token. Install it on the computer where the certificate will be installed, and later on every machine where the token will be used for signing.
Download the latest version from the DigiCert SafeNet Authentication Client download page ↗ (Windows, macOS and Linux).
Important: Install the driver before running the DigiCert installation tool. If this is a renewal, update to the latest driver version first.
Step 2: Get the DigiCert Hardware Certificate Installer
The DigiCert Hardware Certificate Installer is the tool that puts the certificate onto the token. It is only needed during installation and can be uninstalled afterwards.
Download the tool here: DigiCertHardwareCertificateInstaller.zip ↗. Unpack the zip file and run the program. Windows may show a SmartScreen warning because the tool is downloaded directly; it is signed by DigiCert and safe to run.
Step 3: Run the tool with the installation code from the FairSSL email
Insert the USB token and start the DigiCert Hardware Certificate Installer. The tool asks for an installation code: enter the one-time code from the FairSSL email. You do not fetch a code from DigiCert.
The tool connects to DigiCert, retrieves the certificate and installs it directly onto the token. The private key is generated on the token itself and never leaves it.
The code is single-use. If it has been used, has expired or is lost, reply to the FairSSL email or contact us and we will arrange a new one.
Step 4: Initialisation and choosing codes
On the first page after the installation code, the tool shows a checkbox to initialise the token:
- ✓ New token: enable the checkbox. The device is reset and you choose a new password and PIN.
- ✓ Existing token with content: leave the checkbox disabled. Initialisation erases whatever is on the token.
Choose RSA 4096 bit as the key type if the tool asks.
Security codes
- Token Password / PIN: the code you use every time you sign. On most tokens the password and PIN are the same code.
- PUK: used to unlock the PIN if it gets blocked.
- Administrator Password: only used to erase/reset the device together with the PUK. We recommend that you do not change it.
Use only 8-16 characters for new codes. If a longer code is chosen, the tool may accept it even though it will not work on the token afterwards.
Critical warning: If the Administrator Password or PUK is entered incorrectly too many times, the token is permanently destroyed. It cannot be recovered and a new token must be purchased.
Step 5: Sign your code
The certificate is now installed on your USB token and ready to use. You can use the token on other machines by installing SafeNet Authentication Client and inserting the token.
The certificate and private key cannot be copied or exported from the token. The token is the only way to use the certificate. Store it safely.
Example with signtool
signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 /a "MyApp.exe"
The SafeNet driver prompts for your PIN when signtool tries to sign.
Tips and troubleshooting
Always use timestamping
Always add a timestamp when signing. It keeps signatures valid after the certificate expires. DigiCert's timestamp server is http://timestamp.digicert.com.
Single logon
In SafeNet Authentication Client: Client Settings → Advanced → Enable single logon. You are then only asked for the PIN once per session instead of at every signature. Leaving it disabled is more secure.
The token locks after wrong codes
The token locks itself after repeated wrong code attempts. Some software retries automatically and burns through the attempts. Check the remaining attempts in SafeNet Authentication Client.
The installation code does not work
The code is single-use and may have been used or expired. Reply to the FairSSL email and we will send a new one. You do not need to contact DigiCert, and you do not need CertCentral.
Automated CI/CD signing
Automated signing with signtool is technically possible via parameters for the token name, key container name and password. Contact FairSSL for guidance.
DigiCert Code Signing certificates
OV Code Signing
EV Code Signing
Frequently asked questions about the DigiCert USB token
Find answers to the most common questions about SSL certificates and FairSSL.
Ready to order DigiCert Code Signing?
A code signing certificate requires your company to be validated, so it is not issued in minutes. We help you choose the certificate and key storage and keep you informed during validation.