USB eToken management

Sectigo eIDAS qualified certificates for signatures and seals are provided on secure USB eTokens. These devices store and protect the private key used for signing and sealing operations.

Devices and requirements

Supported device types

Sectigo certificates are issued on the following USB eTokens:

  • 5110 CC USB eToken — An eIDAS-compliant Qualified Signature Creation Device (QSCD), required for creating qualified electronic signatures (QES).

  • 5110 USB eToken — A Signature Creation Device (SCD), suitable for creating advanced electronic signatures (AdES).

Private keys are securely generated and stored on the eToken and cannot be exported.

System requirements

To use a USB eToken, your system must meet the following requirements for the operating system:

  • Windows 10 or 11

  • Linux (Red Hat, CentOS, Fedora and Ubuntu)

  • macOS (10.15.7 or later)

Setup and configuration

Once your certificate request is validated:

  • The USB eToken is delivered by mail.

  • You will receive an email with a UPS tracking ID and instructions for issuing and installing your certificate.

  • You will receive access credentials:

    • 5110 USB eToken — Token password

    • 5110 CC USB eToken — Token password and digital signature PIN

Once you confirm receipt of the token, Sectigo will issue the certificate. After the certificate is issued, you will receive an email containing the certificate, which must be installed on the token.

Install SafeNet

To download and install the SafeNet Authentication Client:

  1. Remove your eToken from your device.

  2. Download the SafeNet Authentication Client file.

    OS Download

    Windows:

    • Windows 10

    • Windows 11

    Linux:

    • Red Hat 8 and 9

    • CentOS 8 and 9

    • Fedora 34, 36, and 37

    • Ubuntu 20.04 and 22.04

    macOS:

    • macOS 12.1 (Monterey)

    • macOS 11.6.2 (Big Sur)

    • macOS 10.15.7 (Catalina)

  3. Run the installer.

  4. In the setup wizard, click Next.

  5. Select the preferred language and click Next.

  6. Accept the license agreement and click Next.

  7. Select an installation location and click Next.

  8. Select Typical Install.

  9. Click Install.

  10. Click Finish.

Install your certificate

Once your eToken is delivered:

  1. Follow the instructions in the email from Sectigo.

  2. Use the provided link to retrieve and install your eIDAS certificate onto the eToken.

The email includes:

  • Order number and collection code

  • Certificate issuance link

  • SafeNet Authentication Client download link

If you encounter issues during installation, contact Sectigo Support with your order number and any error messages.

Use and security

Use token

To use your eToken:

  1. Insert the USB eToken into your computer.

  2. When prompted, enter your PIN or password.

  3. Use the certificate to sign, seal, or verify documents.

You must enter your PIN each time you use a qualified certificate. This is required to ensure secure signature creation in compliance with eIDAS requirements.

For more information, see Sectigo eIDAS Qualified Certificate Installation on SafeNet eToken.

Managing your PIN and password

You must change your password and/or PIN after first use.

Do not share your credentials. Store them securely.

The eToken will lock after multiple incorrect attempts. If locked or if credentials are lost, the certificate cannot be recovered and must be reissued. Contact Sectigo Support for further assistance.

Change your password (5110 USB eToken)

  1. Open the SafeNet Authentication Client.

  2. Click Tools  Advanced View.

  3. Right-click SafeNet eToken 5110  Log On to Token.

  4. Enter your current password.

  5. Right-click SafeNet eToken 5110  Change Password.

  6. Enter and confirm a new password.

Use a strong password with at least 12 characters.

Change your password and PIN (5110 CC USB eToken)

  1. Open the SafeNet Authentication Client.

  2. Log in as an administrator or select the option to change the administrator password.

  3. Right-click the token and select Set Token Password.

  4. Enter and confirm the new password.

  5. Right-click the token and select Change Digital Signature PIN.

  6. Enter the Digital Signature PUK.

  7. Enter and confirm the new PIN.

  8. Log out and log in again to verify changes.

Protect your password and PIN with strong encryption.