4

I want to store a OpenVPN client certificates on our laptops secured by my TPM, so that the certificate can't be stolen/extracted from the laptop even with admin rights.

Microsoft offeres "Virtual Smartcards" that use the TPM. I should be able to access them via PKCS11 from the OpenVPN client.config. There are CAPI to PKCS11 libraries/adapters.

I can create a virtual smart card reader using this command:

tpmvscmgr.exe create /name OpenVPN1 /pin prompt /pinpolicy minlen 4 maxlen 8 /adminkey random /generate

This works. However now I need a way to actually generate a public/private key and certificate signing request, that I can sign on my openssl CA.

However Microsoft in their tutorial wants you to connect the computer to a domain with a domain controller. And create a "certificate template" on the domain controller. I don't want/need this. I am not using the Microsoft CA. I have a separate openssl CA.

Is there a way to create a public/private key pair without joining the laptop to a domain?

Improve this question
4
  • 1
    I think the important point here is that the private key must never leave the TPM. As such, the TPM must generate the private key and the CSR.
    – Daniel B
    Dec 21, 2020 at 11:23
  • @DanielB: The question is how can it be done? Can you provide the commands to generate a 2048bit key pair on the TPM backed Virtual Smart card? I don't want to join the machines to a Domain but the Microsoft guides assume that as a precondition.
    – user643011
    Dec 21, 2020 at 15:32
  • No, I can’t. Try some OpenSSL PKCS11 stuff from around the net. You misunderstand though: It’s just the Windows cert GUI that depends on domain membership. Not the process itself.
    – Daniel B
    Dec 21, 2020 at 15:39
  • @DanielB I know there no technical reason why it should not work without domain membership. But I am struggling to find a practical way how to actually do it. I did some more research today, but there is not a lot of information on the web on this topic and I was hoping maybe somebody here has the answer. If I find a way I will post an update.
    – user643011
    Dec 21, 2020 at 16:31

1 Answer 1

Reset to default
3

So to answer my own question:

I didn't find a way to create a keypair on the smartcard directly. But you can import one. And it will be locked in the Virtual Smartcard from that point on (keys will be neverExtract).

First create the smartcard (reader) as per the question with tpmvscmgr.exe create /name OpenVPN1 /pin prompt /pinpolicy minlen 4 maxlen 8 /adminkey random /generate as Admin.

Now certutil -scinfo will show the virtual reader, but will fail showing the certificate, because there is none yet.

In order to proceed you need a combined pkcs12 file. You can create your client keypair off TPM and sign them as usual by your CA e.g. with openssl. If you have the resulting files as separte .key and .crt you may combine them with OpenSSL using e.g. “C:\Program Files\OpenSSL-Win64\bin\openssl" pkcs12 -export -out client.pfx -inkey client.key -in client.crt Be sure to securely wipe those files off your storage once you have them imported into your Virtual Smartcard.

Then you can import it into the Virtual Smartcard with certutil. Run certutil -csp "Microsoft Base Smart Card Crypto Provider" -importpfx client.pfx Be aware that the order of arguments matters: -importpfx has to be provided last.

Now certutil -scinfo will show the certificate.

PS: OpenVPN for Windows is by default compiled without PKCS11 support. But it works directly with CAPI.

Remove cert client.crt and key client.key and instead provide cryptoapicert "THUMB:371f180ba80234845a93b116ea02e5222dffad1e" in your OpenVPN client.conf. Where 371f180ba80234845a93b116ea02e5222dffad1e should be replaced with the fingerprint of your own client certificate. You find your certificate fingerprint in the output of certutil -scinfo after Cert:.

Unfortunately Microsoft's Virtual Smartcard does not support RSA-PSS yet which is required for TLS 1.3 and used by recent OpenVPN with TLS 1.2 too. OpenVPN currently does not detect that it is not available and fails ( https://community.openvpn.net/openvpn/ticket/1296 ) when trying to use it. If this is still unpatched by either MS or OpenVPN you have to use an older OpenVPN version 2.4.8 as a workaround.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .