Knowledge Base › Troubleshooting › Renewing a Certificate Without Rebuilding Your Signing Profiles

Renewing a Certificate Without Rebuilding Your Signing Profiles

Nov 2, 2026 · 3 views

You will learn how to replace an expired cryptographic certificate on your hardware token and update OneSigner to use the new credential without modifying your existing signing profiles, watched folders, or API payload definitions.

Prerequisites and Impact Analysis

Before you begin the renewal procedure, verify that you have administrative access to the Windows machine running the OneSigner service and that your physical hardware token—such as a YubiKey, SafeNet, or ePass2003 device—is plugged directly into the USB port. Remember that OneSigner requires one Windows machine that stays powered on with the hardware token attached; if your operational model requires uninterrupted remote availability without maintaining local hardware, consider migrating your workflow to a managed cloud configuration.

When a certificate expires or is reissued by your certificate authority, the underlying cryptographic key changes, but the structural requirements of your automated jobs remain identical. PDF signing profiles reference the certificate by its serial number, and code-signing profiles by SHA-1 thumbprint, subject name or automatic selection. A renewed certificate always has a new serial number and thumbprint, so every profile pinned to the old serial number or thumbprint must be pointed at the new certificate; everything else in the profile (folders, tenant, appearance, timestamp settings) stays as it is.

For detailed background on how hardware tokens interact with your software configuration, consult the Choosing Your USB Token and CA documentation.

Step 1: Install the New Certificate on the Hardware Token

Obtain your renewed certificate fulfillment package from your certificate authority. Note that since June 2023, the CA/Browser Forum strictly requires certified hardware for Organization Validation (OV) code-signing certificates in addition to Extended Validation (EV) certificates; all code-signing and document-signing operations must utilize compliant hardware tokens.

  1. Insert your USB hardware token into the designated Windows machine running OneSigner.
  2. Open your token management utility (such as the SafeNet Authentication Client or YubiKey Manager) and install the renewed certificate following your CA's instructions (with most CAs the new key pair is generated on the token, or the renewal arrives on a new token).
  3. Open the Windows certificate manager (certmgr.msc for the current user, or certlm.msc for the local machine). Navigate to Personal > Certificates and verify that the new certificate appears with a valid validity period and a functional private key link indicated by the small key icon.
  4. Note the new certificate thumbprint and expiration date for validation in the subsequent configuration steps.

Step 2: Update the Configuration and Profiles

With the new certificate resident in the certificate store and accessible via your USB token, you must update OneSigner so it ceases attempting to sign with the expired material. Rather than deleting your workflows, you will update the certificate binding reference inside your configuration.

Open the OneSigner graphical interface or edit your configuration file directly. Navigate to the signing profiles section where your specific PDF PAdES/AdES or Windows Authenticode profiles are defined. Select the renewed certificate in each profile that used the old one: for PDF profiles this updates the stored serial number, and for code-signing profiles replace the old thumbprint. If a code-signing profile selects by subject name, verify that the subject of the renewed certificate matches exactly. If the renewal came on a new token with a different PIN, update the token PIN saved in the profile as well.

// Excerpt of a PDF signing profile in appsettings.json (Settings > SigningEngine > Profiles)
{
  "Id": "production-pdf",
  "Name": "Production PDF",
  "ProfileType": "pdf",
  "Signs": [
    { "CertificateSerial": "NEW_CERTIFICATE_SERIAL_NUMBER" }
  ]
}

Code-signing profiles keep the thumbprint in CodeSign.CertThumbprint.

If you encounter unexpected errors during this transition, review the diagnostic steps outlined in the Certificate Not Found troubleshooting guide to ensure the Windows service account can properly query the cryptographic service provider.

Step 3: Restart Services and Validate Execution

Because the OneSigner service runs continuously to handle incoming REST API requests, watched folder drops, and automated code-signing tasks, you must restart the service to flush any cached certificate handles.

  1. Open the Windows Services manager (services.msc) or execute an elevated PowerShell terminal.
  2. Restart the OneSigner Windows service by running the following command:
Restart-Service -Name "OneSignerService" -Force
  1. Drop a test file into your watched folder or execute a test signing command via your API client. Verify that the resulting PDF or executable file bears a valid digital signature corresponding to the new certificate's validity dates and serial number.
  2. Check the local application event logs or OneSigner log directory to confirm zero cryptographic exceptions or PIN authentication faults.

For further assistance with error codes or token communication failures during verification, consult the troubleshooting index at Common Errors & Solutions.