Skip to content

Connector · OpenPGP card

OpenPGP Card CSP & Minidriver

Sign in to Windows and to your domain with the OpenPGP card you already use for GnuPG — or turn a JavaCard into one with SmartPGP.

Download minidriver & CSP How-to guide

Free and open source · two drivers, one card

Overview
OpenPGP card on Windows

The OpenPGP card is the smart card of GnuPG: signature, encryption and authentication keys, protected by a PIN. Windows has no driver for it, so out of the box it cannot be used to sign in, for TLS client authentication or for S/MIME.

Two free drivers fill the gap. Pick one per computer, depending on who manages the card:

  • The minidriver plugs the card into the Windows smart card framework, read-only. Keys and certificates are made with GnuPG; Windows uses them. Nothing on the card can be changed by mistake from Windows.
  • The CSP and its KSP let Windows write to the card: the key is generated on the card and the certificate requested from your Active Directory CA with certmgr.msc, like any smart card.

No OpenPGP card at hand? The free SmartPGP applet turns a JavaCard into one. Everything on this page was recorded with SmartPGP on a JavaCard, on Windows 11 joined to an Active Directory domain.

The minidriver: GnuPG writes, Windows reads

With Gpg4win and the domain CA:

  1. gpg-card generate: an RSA 2048 authentication key, on the card
  2. gpgsm --gen-key: a certificate request signed by the card
  3. certreq: the domain CA issues a Smartcard Logon certificate
  4. gpg-card writecert: the certificate goes on the card
  5. Lock the session and sign in to the domain with the card

The same card keeps working with GnuPG for e-mail and SSH. Step by step.

The CSP: Windows enrolls the card from Active Directory

The user enrolls the card alone, with the Windows tools:

  1. certmgr.msc › Request New Certificate
  2. A Smartcard Logon template with a signature key
  3. Private key: the OpenPGP CSP provider
  4. Choose the key slot: Authentication
  5. Admin PIN to generate the key, PIN to sign the request
  6. Sign in to the domain with the card

The CSP also comes with OpenPGP Smart Card Manager, to import a PFX or change the PINs. Step by step.

Minidriver or CSP?
MinidriverCSP and KSP
Access to the card from WindowsRead-onlyRead and write
Who creates the key and writes the certificateGnuPG (gpg-card, gpgsm, Kleopatra)Windows: certmgr.msc, certreq, auto-enrollment
Enrollment from an AD CS CARequest made with gpgsm, submitted with certreqBuilt in, from the enrollment wizard
Windows providerMicrosoft Base Smart Card Crypto Provider and Smart Card KSPOpenPGP CSP and OpenPGP KSP (Windows 11 uses the KSP first)
Key used by WindowsThe authentication key (signature container)The slot chosen when the key is generated
Domain smart card logonYes, with the allow signature keys policyYes, with a signature-key template
TLS client authentication, S/MIME signingYesYes
Decryption (S/MIME, EFS) on SmartPGPNoNo — only on cards with MSE
PFX import, PIN changeNo (GnuPG does it)Yes, OpenPGP Smart Card Manager
InstallationDriver package, then the card ATR in the registryMSI, then the card ATR in the registry
Best forGnuPG users who also want Windows logon; cards managed outside WindowsCompanies enrolling cards from their own PKI

Install one of the two for a given card: both register for the same ATR.

Screenshots
Key generation with GnuPG gpg-card asks for the admin PIN before generating the key on the card.
Certificate written by gpg-card The authentication key and the certificate from the domain CA, as GnuPG sees the card.
The OpenPGP CSP in the enrollment wizard Private Key tab: the provider that generates the key on the OpenPGP card.
Choose the key slot Without MSE on the card, the Authentication slot signs but does not decrypt.
Smart card logon The OpenPGP card and its PIN on the Windows 11 sign-in screen.
Requirements and limits
Card
  • OpenPGP card v2 or v3, or the SmartPGP applet on a JavaCard 3.0.1 or later
  • RSA 2048 keys
  • Room for the certificate: Active Directory certificates are 1.5 to 2 KB, more than the 1 KB of the standard SmartPGP build — see the how-to guide
  • Decryption with the logon key needs MSE (key swap) on the card; SmartPGP does not implement it
Computer and domain
  • Windows 10 or 11, x64 (x86 build available)
  • The ATR of the card registered for the driver (pre-configured for genuine OpenPGP cards)
  • Minidriver: the Allow signature keys valid for logon policy
  • CSP: a Smartcard Logon template whose key is a signature key
  • Domain logon: the usual smart card logon prerequisites — domain controller certificate, CA in NTAuth
FAQ

To keep the card under the control of GnuPG, and to comply with the Windows certification requirements for minidrivers. Windows cannot generate a key or write a certificate through it: use gpg-card, gpgsm or Kleopatra, or install the CSP instead.

With the minidriver, the certificate sits on the signature container of the card: enable Allow signature keys valid for Logon (Computer Configuration › Administrative Templates › Windows Components › Smart Card), then remove and insert the card. Also check that the certificate was written to the authentication key (OPENPGP.3) and that certutil -scinfo passes the public key matching test.

The standard Smartcard Logon template asks for a key that both signs and decrypts. An OpenPGP card has one key per use, and SmartPGP cannot swap them (no MSE), so the CSP offers the authentication key, which signs only. A copy of the Smartcard Logon template whose purpose is Signature matches it.

Windows chooses the driver from the ATR of the card. Genuine OpenPGP cards are pre-configured; a JavaCard with SmartPGP has its own ATR: read it with certutil -scinfo and register it, see the how-to guide.

Yes: EIDAuthenticate signs in local accounts with any card Windows can read, so a self-signed certificate on the OpenPGP card is enough on a computer outside a domain.

Both drivers are open source: the CSP and KSP and the minidriver are on GitHub. Contributions are welcome.