Ugo, I have been reading PKCS#11 technical document and there is something I don´t understand. This is the snippet you sent to me (with the change I did in parameter Byval cert As string in order to sent a path with the pfx file):

Function ImportKeyPair(ByVal Session As Session, ByVal cert As String, ByVal password As String, ByVal id As String, ByVal label As String, ByVal priv As Boolean, ByVal modifiable As Boolean) As PrivateKey
Try
Dim certificate As X509Certificate2
certificate = New X509Certificate2(cert, password, X509KeyStorageFlags.Exportable)
If (Not certificate.HasPrivateKey) Then
Throw New Exception("Certificate doesn't have private key. Import failed!")
End If
MessageBox.Show(certificate.GetExpirationDateString)
MessageBox.Show(certificate.Issuer)
Dim keyPair As RSA
Dim keyParams As RSAParameters
Dim template As CryptokiCollection
Dim priKey As PrivateKey
keyPair = certificate.PrivateKey
keyParams = keyPair.ExportParameters(True)
template = New CryptokiCollection()
template.Add(New ObjectAttribute(ObjectAttribute.CKA_CLASS, CryptokiObject.CKO_PRIVATE_KEY))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_SUBJECT, certificate.SubjectName.RawData))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_ID, id))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_LABEL, label))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_TOKEN, True))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODULUS, keyParams.Modulus))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PUBLIC_EXPONENT, keyParams.Exponent))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE_EXPONENT, keyParams.D))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_PRIVATE, priv))
template.Add(New ObjectAttribute(ObjectAttribute.CKA_MODIFIABLE, modifiable))
priKey = Session.Objects.Create(template)
ImportKeyPair = priKey
End Function

My doubt is the following: with the template you create, does the pfx file copy to smart card? I don´t understand why CKA_CLASS is CryptokiObject.CKO_PRIVATE_KEY instead of CryptokiObject.CKO_CERTIFICATE.

With the software tools the manufacturer gives, I can see in token the certificate and private key. I delete them from Manufacturer tools and I try again with this code, but I can´t... I give you more information. With Manufacturer Tools I have to select "Import digital ID" instead of "Import certificate". When I import digital ID I can see the certificate and private key.

I have not been able to avoid 209 error (TEMPLATE_INCONSISTENT) with this snippet.

Thanks again.

Rgds,

Ugo, this is crazy. I have tested with 3 different smart cards (HID Crescendo C700 (HID), ACOS5 (ACS) and Touch&Sign 2048 (bit4id)). With the first one (the smart card I want to work) I have commented one by one the attributes of your snippet and the problem is the same (Template_Inconsistent). I have added CKA_ALWAYS_SENSITIVE and CKA_EXTRACTABLE (one by one too) and the problem persists.

I have tried with ACOS5 card and the error is different (ATTIBUTE_TYPE_INVALID). I have commented one by one the attributes and the problem is the same.

I have tried with Touch&Sign 2048 and "it works", but this is not the card we want to use. Anyway, do you have the snippet to load the certificate once the private key is loaded?

I think the only solution I have is talking to HID in order to get necessary attributes for private key and certificate.

Thank you.

Thank you, Ugo. This is very frustrating. Everybody says I must Use CryptoAPI instead of PKCS#11, because it is very difficult to manage if you don´t use C++.  You have helped me a lot, so I think we are next to the solution. I will wait.

Thank you, again.

Rgds,

Thank you, Ugo. Yes, I have an example HID sent to me. Can you give me your e-mail address?