Knowledge Base › Troubleshooting › Certificate Not Found

Certificate Not Found

Apr 5, 2026 · 498 views

OneSigner reports "Certificate not found", or the certificate dropdown is empty. Work through these checks in order — the first three fix the vast majority of cases.

1. Is the Token Physically Connected?

  • Re-seat the USB token; try a different port (avoid unpowered hubs).
  • Device Manager → Smart card readers — the token must be listed without warnings.
  • On VMs: pass the USB device through to the guest; on RDP: enable smart-card redirection.

2. Is the Certificate in the Windows Store?

  1. Run certmgr.msc as the same Windows user that OneSigner signs as (the logged-in desktop user for service signing).
  2. Personal → Certificates: your certificate must appear with a key icon (private key present).
  3. Missing? Use the token vendor tool to propagate/register certificates, or re-insert the token — most CSPs auto-register on insertion.

3. Is the Vendor Driver Installed?

  • SafeNet: SafeNet Authentication Client shows the token and its certificates.
  • YubiKey: YubiKey Manager → PIV → the certificate is in slot 9a or 9c.
  • ePass2003: vendor manager shows the certificate.

If the vendor tool can't see the token, OneSigner can't either — fix the driver first.

4. Service Mode: the Session Requirement

USB tokens are only reachable from an interactive desktop session. The Windows service itself runs in Session 0; OneSigner automatically spawns its signing work into the logged-in user's session — but that session must exist:

  • A user must be logged in (locked screen is fine; logged out is not).
  • For 24/7 servers, enable Auto-Logon in the General tab.
  • Details: Signing Fails in Service Mode.

5. Restart the Smart Card Service

net stop SCardSvr
net start SCardSvr

Then unplug/replug the token.

6. Still Stuck?

  • Check GET /api/signing/certificates (admin token) — it lists exactly what the signing session can see, including token type.
  • Two tokens with the same certificate subject? Select by serial/thumbprint in the profile to disambiguate.
  • Contact support@onesign.sg with a screenshot of certmgr.msc and the portal Logs page.