If you just received a Sectigo code signing certificate on a hardware token, your signing tool won’t see it until one piece of software is sitting on your machine: the SafeNet Authentication Client. Skip it, and SignTool or Visual Studio will act like the token doesn’t exist. Here’s what SAC does, where to get it, and how to get past the installation snags that trip up most first-time setups.

What Is the SafeNet Authentication Client?

Sectigo code signing certificates issued on a USB token or smart card never let the private key leave the hardware. That’s the entire point of a hardware token, it keeps the key from being copied, exported, or lifted off a compromised machine. But your operating system has no native way to talk to that hardware.

That’s where SAC comes in. It’s middleware built by Thales (the company that used to operate under the Gemalto name) that acts as a translator between your OS and the token. Once installed, Windows or macOS can see the certificate, and your signing tool can request a signature without ever touching the raw private key.

If you’ve also worked with DigiCert-issued tokens, you may have used a similar client from DigiCert’s own KSP or PKCS#11 tooling. They serve the same purpose, bridging OS and hardware, but they’re built and maintained separately, and installers aren’t interchangeable across CAs. Always use the client your certificate authority points you to.

Before You Start — Prerequisites

A few things save you a wasted install attempt:

• Administrator or sudo access. SAC installs drivers, not just an application. Without elevated rights, the installer will either fail outright or complete without registering the driver properly.
• Keep the token unplugged until told to connect it. Installing with the token already inserted is the single most common cause of a token that “installs fine but doesn’t get recognized.”
• Close Visual Studio, SignTool, or any other signing tool running in the background. An open handle to a signing process can interfere with driver registration mid-install.
• Locate your token password before you start. Sectigo emails this to your certificate administrator alongside the shipping confirmation once the token ships — separate from the download itself. You’ll need it to unlock the token after installation, not during.

SafeNet Authentication Client Download for Windows

Get SAC directly from Sectigo’s own download page, not a search result, not a forum link, not a third-party mirror. Hardware token middleware is exactly the kind of file attackers like to bundle with something extra, so treat the source the same way you’d treat the certificate itself.

The file arrives as a compressed .zip or .iso containing the installer, release notes, and a user guide. Extract it fully before running anything, some antivirus tools flag partial extractions or block execution from inside a zip container, which looks like a broken installer when it’s really a permissions issue.

Choosing the Right Installer — 32-bit vs. 64-bit

Inside the extracted folder you’ll find separate directories for x86 and x64 builds. Match the installer to your Windows architecture, not to habit, running the wrong build is a common reason installs silently fail partway through.

Your Windows System	Installer to Use
64-bit Windows 10/11 (most current machines)	x64 (SafeNetAuthenticationClient-x64)
32-bit Windows (legacy or older hardware)	x86 / x32

Not sure which you’re running? Check Settings > System > About and look at “System type” before you pick a folder.

SafeNet Authentication Client MSI Installer Walkthrough

Once you’ve confirmed the right build, installation itself is short:

1. Right-click the .msi file and choose Run as administrator.
2. Click Next on the installation wizard welcome screen.
3. Select your interface language and continue.
4. Accept the license agreement.
5. Choose a destination folder — the default path works for nearly everyone.
6. Select Typical Install unless your organization has a specific reason to customize the feature set.
7. Click Install, then Finish once the progress bar completes.
8. Restart your computer. This step isn’t optional — the driver layer doesn’t fully register until after reboot.

After restarting, plug in your token for the first time. SAC should detect it within a few seconds of insertion.

Installing on macOS

Sectigo provides a macOS build of SAC alongside the Windows package. The installer runs through the standard macOS package flow, double-click the .pkg file, walk through the on-screen prompts, and authenticate with your administrator password when requested.

The same rule applies here as on Windows: install first, connect the token second. Once installation finishes, open the SafeNet Authentication Client Tools from your Applications folder before plugging in the USB device, so the client is already listening for it.

Setting Up Your Sectigo Token After Installation

With SAC installed and your machine restarted, connect the token and open the client from the Start menu (Windows) or Applications folder (macOS). You should see the token populate in the interface within a moment, showing the certificate stored on it.

How to Change Your Token Password

Sectigo ships every token with a default password, sent by email to your certificate administrator at the time of shipping. Changing it is optional but strongly recommended, particularly if more than one person has access to the physical token.

Inside SAC, select Change Token Password. Enter the current password from your issuance email, then set a new one that meets SafeNet’s complexity requirements, typically a mix of upper and lowercase letters, numbers, and a minimum length. Store the new password somewhere your team can retrieve it; there’s no password reset for a hardware token, only a support case.

Troubleshooting Common SafeNet Authentication Client Issues

Most support tickets on this topic fall into three buckets. Here’s what’s usually behind each one.

SafeNet Authentication Client isn’t detecting my token. Check the obvious first: is the token fully seated in the USB port? Try a different port, preferably a direct one rather than a hub or dock. If that doesn’t fix it, uninstall SAC completely, restart, and reinstall with the token unplugged. A driver conflict from an old SAC version is the next most common cause, check Programs and Features for any prior SafeNet installs before reinstalling.

My certificate isn’t showing up in the Windows certificate store. This almost always means SAC installed but the token wasn’t properly registered with it. Open SAC, confirm the token appears with your certificate listed inside the client itself. If it’s visible there but not in the Windows store, close and reopen your signing tool, some versions of Visual Studio cache the certificate store and won’t refresh mid-session.

The .msi file is missing or won’t open from the downloaded package. Re-download the file rather than troubleshooting a corrupted archive. A partial download or an antivirus quarantine action can silently strip the installer out of the zip without any visible error. Extract to a fresh folder outside of any cloud-sync directory (OneDrive, Dropbox), since sync clients sometimes lock files mid-extraction.

Frequently Asked Questions

Do I need 32-bit or 64-bit SafeNet Authentication Client for Windows? Check System type under Settings > System > About. Nearly all machines sold in the last several years run 64-bit Windows and need the x64 installer; older or specialized hardware may still require x86.

How do I install SafeNet Authentication Client on macOS for Sectigo? Download the macOS .pkg build from Sectigo’s SAC download page, run it through the standard macOS installer flow, and authenticate with an admin password. Install before connecting the token, not after.

Is SafeNet Authentication Client the same as the DigiCert client? No. Both are middleware that bridge your OS and a hardware token, but they’re built by different vendors and aren’t interchangeable. Use the client your issuing certificate authority provides for your specific token.

Why isn’t my token password working? Confirm you’re using the password from the original issuance email, not a password you may have set previously for an unrelated account. If the token locks after repeated failed attempts, you’ll need to open a support case with Sectigo — there’s no self-service unlock for a hardware token.

Need Help With Your Sectigo Code Signing Token?

Hardware token setup is one of those processes that’s straightforward once you’ve done it and confusing the first time through. If you’ve followed the steps above and your token still isn’t cooperating, reach out to our support team, we work with Sectigo code signing tokens daily and can usually spot the issue in a few minutes.