5

I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either.

It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. Unfortunately the user-experience is terrible. It requires its own special driver instead of using Microsoft's own standard USB security token driver or emulating a smart-card device. The UI is horribly designed and covered in logos. It's also impossible to get drivers directly from SafeNet / Gemalto, they're distributed by the CA (in this case, GlobalSign). I had issues with the driver's background service refusing to start and my Windows logon-screen now has 6 extra buttons for duplicate token devices even when the USB token isn't plugged in.

GlobalSign also requires the use of Internet Explorer on Windows (not even Edge) to provision the USB token because it uses the Windows Certificate provisioning ActiveX control - you're SOL if you're on Linux or Mac, but at least after the token is provisioned you can use the token with a Mac. This provisioning process is what puts my private-key and the CA-issued cert on the token.

I would like to extract my information from the token and move it to a better-implemented device, such as another USB token that doesn't require special drivers, similar to the experience I had with my old employer's smartcard-based PKI).

What options do I have?

Improve this question

2 Answers 2

Reset to default
3

Once you have deployed a private key in a USB Dongle it is impossible to extract it. This is the main reason to use a USB Dongle, to ensure the key is always hardware protected.

The only option is to generate a new private key and request a new certificate

Improve this answer
2
  • Isn't capturing the certificate using Fiddler when the cert is downloaded to be installed in the token an option?
    – Gaia
    Nov 16, 2018 at 16:00
  • 3
    The certificate is a public key signed by a CA. As you said it can be copied when it is downloaded or simply extracted from the token. The related private key is generated inside the token and can`t be extracted or copied.
    – Jofre
    Nov 16, 2018 at 19:20
2

GlobalSign supports the installation of your certificate on a token or smart card that uses the Microsoft Base Smartcard Crypto Provider* in place of a Safenet token.

*https://support.globalsign.com/customer/portal/articles/1999625 (Mentioned under Prerequisites and Step 5 of the installation)

Improve this answer
2
  • Yep! I was able to order a blank Smartcard and a Smartcard reader that used Windows' built-in drivers and get my GlobalSign certificate installed on it using those instructions.
    – Dai
    Feb 19, 2018 at 0:09
  • Are you able to extract the private key when you go the route of installing it in a 3rd party smartcard?
    – Gaia
    Nov 16, 2018 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.