smctl-cheat-sheet.md

SMCTL.EXE Cheat Sheet

List Available Certificates

To see all certificates available on the token:

smctl.exe list-certificates

View Certificate Details

Check details of a specific certificate:

smctl.exe cert-details -cert "My Digital Signature"

Sign a File

Digitally sign an executable or document:

smctl.exe sign -file input.exe -o signed.exe -cert "CN=MyCompany"

Sign a File with Hash Algorithm

Specify the hashing algorithm for signing:

smctl.exe sign -file input.exe -o signed.exe -cert "My Digital Signature" -hash SHA256

Sign a PDF Document

To sign a PDF file:

smctl.exe sign -file document.pdf -o signed_document.pdf -cert "My Digital Signature"

Sign a PowerShell Script

Sign a PowerShell script for execution policy compliance:

smctl.exe sign -file script.ps1 -o signed_script.ps1 -cert "My Digital Signature"

Sign a Code Signing Certificate (for software distribution)

smctl.exe sign -file software.exe -o signed_software.exe -cert "Code Signing Certificate"

Verify a Signed File

Check if a file is properly signed:

smctl.exe verify -file signed.exe

Set Publisher (Ensure Correct Certificate)

To ensure the correct publisher is used for signing:

smctl.exe sign -file input.exe -o signed.exe -cert "CN=MyCompany, O=MyOrganization"

Check Signature with SignTool

Use Windows SignTool to verify a signed file:

signtool verify /pa signed.exe

Automate Signing in a CI/CD Pipeline

To automate signing in a DevOps pipeline:

smctl.exe sign -file build_output.exe -o signed_output.exe -cert "My Digital Signature" -pin "TOKEN_PIN"

Extract Certificate from Token

To extract a certificate for external use:

smctl.exe export-cert -cert "My Digital Signature" -o my_cert.pem

Revoke a Certificate

If a certificate needs to be revoked:

smctl.exe revoke-cert -cert "My Digital Signature"

Troubleshooting

Token Not Recognized

Try reconnecting the token and restarting the service:

sc stop SafenetAuthenticationService
sc start SafenetAuthenticationService

Incorrect PIN or Authentication Issues

Reset the token if you forget the PIN:

smctl.exe reset-token