Windows Certificate Store - Generating / importing personal certificates using a smartcard?

Question

I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC).

Now I'm having the problem, that I own a smartcard and I want to use it with Windows (7). However my card doesn't support ex- nor importing private keys (which is a feature, not a bug), I can only generate them on the device.

The problem I'm facing is that I want to have my personal (/client-) certificate (which is signed by my personal self-signed root CA) being accessible by Windows.

There are multiple options I've explored so far:

1. Try to use certmgr.msc to generate my own certificate / private-key pair, which needs some strange setup I don't understand.
2. Use XCA, to manage the CA and generate a key on the device, later being signed using the CA key (using XCA). Then import the certificate into the Windows Store (without the private key) and hope things work. (Hint: They don't, for one of my personal certificates it says "you don't have the private key", the other somehow worked to accept Windows to "own" the private key, but operations using this key seem to fail (Putty-CAC))

Now my question: What is the best route to get the keys being accepted by Windows?

One last point: I considered posting this at SuperUser, but I posted here, because this requires special security hardware and deep understanding of the security functions of Windows.

Answer 1

For the most part, smartcard integrations requiring pointing your email client at your smartcard reader & middleware, ensuring the proper crypto library is selected. There is mucho information on doing this with both OpenPGP smartcards and x509 smartcards

Depending on the email client, the Windows trust store can be used, or not used.

Your operating system does not actually require access to the private key. Instead, you interact with the private key through the smartcard reader and middleware. Your authentication step (typing in the PIN) enables the smartcard to perform decryption or authentication events on your behalf then. Performing this crypto-offload on the smartcard is more secure since the private key is on the smartcard, not exposed to the file system, and stealing your private key is no longer easy.

Putty-CAC & Smartcard integration

To register Putty-CAC with a working smartcard, assuming your smartcard reader and middleware are already installed and working:

• Execute Putty-CAC
• Scroll down to SSH & expand it
• select CAPI
• Select Cert and Browse
• Select the smartcard certificate that corresponds to the cert you want to use
• Use that for setting up SSH on the remote host

Technically, this is only RSA based SSH, not certificate based SSH, so you will miss out on some of the nifty security features of certificates

You can find expanded instructions here

Certificate Registration

Some middleware, such as ActivIdentity which is very popular, include a function for registering certificates with the Windows.

Activclient > smartcard reader > My Certificates > Select Certificate > Make available to WIndows

Additionally see the following:

Encrypting Messages w/ SMIME in Outlook Webapp

Thunderbird DoD Smartcard Configuration

Using an OpenPGP Smartcard