# Windows facilities to generate keys and sign certificate signing requests on smart-cards

Does windows Vista/7 provide some sort of generic utilities and facilities to generate a non-exportable RSA/DSA key on a smart-card and sign a CSR from a smart-card?

any hints/tips/pointers appreciated.

P.S. I know about the PKCS15 as provided by OpenSC/OpenCT

-

Normally smart cards for logons in Windows are handled by Active Directory Certificate Services. The Windows Server role handles the creation, issuance and PKI infrastructure to manage smart cards.

I'm not sure about a purely client-based solution however.

-

Most smartcards have a PKCS#11 Interface. The GnuTLS Tools collection can access Smartcards through PKCS#11. There is a Windows Version of GnuTLS on the Project Homepage. There is a short Example Section in the GnuTLS Documentation

What you also need is a PKCS#11 driver for your Smartcard, which you will probably find on the Homepage of the Manufacturer of the Card. You can point GnuTLS to the driver using the --provider="C:\path\to\pkcs11-dll\my_p11_driver.dll" Option.

Some Smartcards might have an Option to import self-made keys and mark these "non exportable". Others have pre-installed Keys, which are "non-exportable" by default. You can create certificates (or cert requests) for this Keys using the certtool from GnuTLS. It is open for discussion whether you want to trust key material, that comes pre-installed. But manufacturers usually advertise that the key material was created in a safe environment from specialized hardware-appliances without any external connections.

-