So to answer my own question:
I didn't find a way to create a keypair on the smartcard directly. But you can import one. And it will be locked in the Virtual Smartcard from that point on (keys will be
First create the smartcard (reader) as per the question with
tpmvscmgr.exe create /name OpenVPN1 /pin prompt /pinpolicy minlen 4 maxlen 8 /adminkey random /generate as Admin.
certutil -scinfo will show the virtual reader, but will fail showing the certificate, because there is none yet.
In order to proceed you need a combined pkcs12 file. You can create your client keypair off TPM and sign them as usual by your CA e.g. with openssl. If you have the resulting files as separte .key and .crt you may combine them with OpenSSL using e.g.
“C:\Program Files\OpenSSL-Win64\bin\openssl" pkcs12 -export -out client.pfx -inkey client.key -in client.crt Be sure to securely wipe those files off your storage once you have them imported into your Virtual Smartcard.
Then you can import it into the Virtual Smartcard with
certutil -csp "Microsoft Base Smart Card Crypto Provider" -importpfx client.pfx
Be aware that the order of arguments matters:
-importpfx has to be provided last.
certutil -scinfo will show the certificate.
PS: OpenVPN for Windows is by default compiled without PKCS11 support. But it works directly with CAPI.
cert client.crt and
key client.key and instead provide
cryptoapicert "THUMB:371f180ba80234845a93b116ea02e5222dffad1e" in your OpenVPN
client.conf. Where 371f180ba80234845a93b116ea02e5222dffad1e should be replaced with the fingerprint of your own client certificate. You find your certificate fingerprint in the output of
certutil -scinfo after
Unfortunately Microsoft's Virtual Smartcard does not support
RSA-PSS yet which is required for TLS 1.3 and used by recent OpenVPN with TLS 1.2 too. OpenVPN currently does not detect that it is not available and fails ( https://community.openvpn.net/openvpn/ticket/1296 ) when trying to use it. If this is still unpatched by either MS or OpenVPN you have to use an older OpenVPN version 2.4.8 as a workaround.
I have to thank the mysmartlogon.com team for providing some ideas and hints to this answer. Great company, highly recommend their products! Hope this is useful.