I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC).
Now I'm having the problem, that I own a smartcard and I want to use it with Windows (7). However my card doesn't support ex- nor importing private keys (which is a feature, not a bug), I can only generate them on the device.
The problem I'm facing is that I want to have my personal (/client-) certificate (which is signed by my personal self-signed root CA) being accessible by Windows.
There are multiple options I've explored so far:
- Try to use certmgr.msc to generate my own certificate / private-key pair, which needs some strange setup I don't understand.
- Use XCA, to manage the CA and generate a key on the device, later being signed using the CA key (using XCA). Then import the certificate into the Windows Store (without the private key) and hope things work. (Hint: They don't, for one of my personal certificates it says "you don't have the private key", the other somehow worked to accept Windows to "own" the private key, but operations using this key seem to fail (Putty-CAC))
Now my question: What is the best route to get the keys being accepted by Windows?
One last point: I considered posting this at SuperUser, but I posted here, because this requires special security hardware and deep understanding of the security functions of Windows.