Smart Card Logon Certificate Registry Locations

This article provides an overview of where the Windows Registry stores information regarding smart card cryptomodules, minidrivers, and the certificates utilized for smart card logon. It details the specific registry paths used by the Windows Cryptographic Architecture (CryptoAPI and CNG) to detect card modules, manage cryptographic service providers, and cache user and root certificates.

Smart Card Database and Cryptomodules

Windows stores information about recognized smart card modules, their ATR (Answer-to-Reset) strings, and the associated cryptographic minidrivers or Cryptographic Service Providers (CSPs) at:

• Primary Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais\SmartCards
• 32-bit Compatibility Path (on 64-bit systems):
  HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Calais\SmartCards

Under each card-specific subkey, the registry defines the module configuration, including: * Crypto Provider: Specifies the CSP handling the card. * Smart Card Key Storage Provider: Specifies the CNG Key Storage Provider (KSP) DLL for modern smart card minidrivers. * 80000001: Binary value representing the ATR string mask.

Cryptographic Service Providers (CSP) and Key Storage Providers (KSP)

The registered cryptographic engines responsible for communicating with the card modules are located in the following keys:

• CSPs (Legacy CryptoAPI):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider
• KSPs (Cryptography Next Generation / CNG):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers

User Certificate Store (Smart Card Certificate Propagation)

When a smart card is inserted, the Windows Smart Card Certificate Propagation service reads the public certificates from the card and caches them into the user’s personal certificate store:

• Current User Personal Store:
  HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\My\Certificates

Each subkey under Certificates corresponds to the SHA-1 thumbprint of a certificate. For smart card certificates, these entries contain properties linking the public certificate back to the CSP/KSP and the smart card container name.

Smart Card Logon Validation (NTAuth Store)

For domain authentication, Windows verifies that the issuing Certificate Authority (CA) exists in the enterprise NTAuth store. The registry replica of this store is located at:

• Enterprise NTAuth Store:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\NTAuth\Certificates
• Group Policy Pushed Store:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates