OpenVPN/easy-rsa — pull request #5 by Wesseldr (2013-06-03 22:49:56+00:00)
Title: Add support for using a PKCS#11 SmartCard/Token containing a ROOT CA for signing the certificates

This pull request adds full support for creating and using a PKCS#11 smart-card or token which is loaded with a ROOT CA to sign the certificates. Using a token instead of using a file to sign certificates has a huge security advantage as unauthorised copying of the private keys is impossible once it's stored on a smart-card or token.
Needs opensc 0.12+

New features for supporting PKCS#11 SmartCards & Token
--pkcs11-initca
Build a root CA inside a PKCS#11 token and set the authority bit on the certificate. Most software will automatically trust the CA on the token. Advantage is the private key of the CA can never by copied or stolen. Disadvantage, if you break the token you lost the CA.

--pkcs11-loadca
Load the existing root CA (priv/pub/crt) from the keys directory into a PKCS#11 token

--pkcs11-use-tokenca
Use this in combination with:
clientName : Build a new client certificate and sign it with the CA stored in the CA token
--server:Build a new server certificate and sign it with the CA stored in the CA token
--sign: Sign an existing CSR with the CA stored in the CA token
--pkcs11:generate certificate on PKCS#11 token and sign it with the CA stored in the CA token. It will ask to swap the tokens between the client/server token and the \*CA Token*. You could use them both inserted and figure out which one lives on which slot and enter that as parameters.

Misc
In case of a wrong pin-code was entered or the smart-card reader was not ready yet, it will show the error and will ask again for a retry.

Tested
I've tested it with a Feitian: SCR301, SCR310 smartcard raders and a ePass2003 token

Cheers,
Wessel