Home / Docs / Code signing certificate install guide

Code signing certificate install guide

UKey driver install, token initialization, signing and verifying with DigiCert Utility.

Code signing certificate install guide

This guide covers a code-signing certificate on a hardware UKey (USB token): installing the driver, initializing and downloading the certificate, signing files, and verifying signatures.

1. Install the UKey driver

Install the SafeNet Authentication Client driver (ask us for the matching 32-bit / 64-bit package):

  1. Run the driver and click Next.
  2. Choose the language (English or Chinese), click Next.
  3. Accept the license agreement, click Next.
  4. Choose the install path (default recommended), click Next.
  5. Choose Typical, click Next.
  6. Click Install, then Finish when done.

2. Initialize the UKey and download the certificate

  1. Insert the USB key and download DigiCert Hardware Certificate Installer.exe from the link in your email.
  2. Run it, click Next, accept the license, click Next.
  3. Enter the certificate download passcode, click Next. If it cannot reach the DigiCert site, append 64.78.193.234 www.digicert.com to your hosts file (C:\Windows\System32\drivers\etc\hosts) or switch networks; ignore if there is no such error.
  4. Check Re-initialize my token and permanently delete any existing certificates and keys, click Next.
  5. Key Type RSA, Key Size 4096, click Next.
  6. Set a Token Name and Token Password, click Next.
  7. Keep Use factory default Administrator password checked, click Finish. Do not unplug the UKey during download.
  8. Click Close when finished; open SafeNet Authentication Client and refresh to see the certificate.
Keep the UKey and its password safe to avoid losing or damaging the certificate.

3. Sign files with DigiCert Utility

Download DigiCert Utility (https://www.digicert.com/StaticFiles/DigiCertUtil.exe):

  1. Run DigiCertUtil.exe, click Code Signing, choose your certificate, click Sign Files. If the certificate is not listed, re-plug the UKey so the PC detects it.
  2. In the Code Signing window click Add Files and select the files to sign.
  3. Enter the timestamp URL, ensure Add a timestamp to the signature is checked, click Sign (timestamping needs internet).
  4. A timestamp keeps signatures valid after the certificate expires.
  5. When you see All the files have been successfully signed, click OK.

4. Verify the signature

  1. In DigiCert Utility's Code Signing screen click Check Signature and pick the signed file.
  2. A green check with The file is signed and the signature was verified means it is correctly signed; The signature was time stamped by DigiCert Inc on 'Date and Time' means the timestamp was added.
← Docs