Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does windows Vista/7 provide some sort of generic utilities and facilities to generate a non-exportable RSA/DSA key on a smart-card and sign a CSR from a smart-card?

any hints/tips/pointers appreciated.

P.S. I know about the PKCS15 as provided by OpenSC/OpenCT

share|improve this question

Normally smart cards for logons in Windows are handled by Active Directory Certificate Services. The Windows Server role handles the creation, issuance and PKI infrastructure to manage smart cards.

I'm not sure about a purely client-based solution however.

share|improve this answer

Most smartcards have a PKCS#11 Interface. The GnuTLS Tools collection can access Smartcards through PKCS#11. There is a Windows Version of GnuTLS on the Project Homepage. There is a short Example Section in the GnuTLS Documentation

What you also need is a PKCS#11 driver for your Smartcard, which you will probably find on the Homepage of the Manufacturer of the Card. You can point GnuTLS to the driver using the --provider="C:\path\to\pkcs11-dll\my_p11_driver.dll" Option.

Some Smartcards might have an Option to import self-made keys and mark these "non exportable". Others have pre-installed Keys, which are "non-exportable" by default. You can create certificates (or cert requests) for this Keys using the certtool from GnuTLS. It is open for discussion whether you want to trust key material, that comes pre-installed. But manufacturers usually advertise that the key material was created in a safe environment from specialized hardware-appliances without any external connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.