I am a user requiring a legal signature to be installed on a SAP/R3 application. For the past few years a service provider provided a X.509 advanced signature certificate that could be exported as a .pfx file and installed on SAP.

A new service provider supplied a dongle with PKCS#7 and a separate private key is required to create a .pfx file. As far as I understand the private key is encrypted on the dongle. They also informed me that they are not allowed to provide the private key.

Is there a way to create a .pfx file using this dongle?

If not, how do I correctly specify the requirement of a X.509 advanced signature that can be used to create the .pfx file?


A PFX file is better known as a PKCS#12, the "Personal Information Exchange Syntax". It is used either as a trusted certificate store or as a key store. When it is used as a (private) key store it generally contains entries with a private key and the certificate chain associated with it (leaf certificate, CA certificates and root certificate usually).

If your key is in a hardware token then generally you cannot extract it. So your software needs to reference it some way or other. For this another standard from the PKCS range is commonly used, namely PKCS#11. PKCS#11 is also known as Cryptoki. Microsoft unfortunately has a bad track record when it comes to keeping to standards and uses a CSP (Cryptographic Service Provider). PKCS#11 libraries and CSP's are token specific and should be available from the vendor.

To use the device your software should support a PKCS#11 interface or it should use the Microsoft Cryptography API in a generic way (it is possible to use the "managed" classes, but then you'll be stuck with a software-only implementation). OpenSSL also has a PKCS#11 engine if that's your poison.

PKCS#7 is the "Cryptographic Message Syntax". It is used to sign / encrypt data. However, because it can also carry certificates it is sometimes used as a certificate store as well. It is not a key store, so the private key won't or shouldn't be in it.

X.509 is a standard of certificates and CRL's. It can specify a lot of things, but it cannot be used to specify where the private key is stored. As such the last part of the question is unclear and cannot be answered in my opinion.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.