Rate this Content

0 Rates
0 %

My smart card is not full and I cannot enroll new certificates.

Applies to

All Classic Client versions


The smart cards compatible with Classic Client house several key containers. One can import a certificate and its associated key pair (keyset) in each container. However it is not possible to import any keyset in any container. Each container has three parameters that need to match the keyset:

  • Key length (512, 1024, 2048...)
  • Signature Capability
  • Decryption Capability

This explains why sometimes your card is not full but you cannot enroll new certificates. The card no longer has key containers matching the keyset.



This card has four key containers but I cannot import new certificates which associated key pair has Signature and Decryption capabilities and is 1024 bit long.

More information

  • It may not be easy to know the signature and decryption capabilities related to one certificate. The easiest way is import it in a card containing several types of empty containers and to check in which container it goes. You can also look at the key usage and enhanced key usage of your certificate.
  • The three parameters have to match exactly, a container with Signature and Decryption capabilities cannot contain a Sign-Only keyset.


Modifications to the operating system can lead to unrecoverable errors. Modifications are reserved to advanced users. If you do not feel confident we recommend creating a System Restore Point before performing changes.

No comments
Add comment

* - required field


CAPTCHA image for SPAM prevention If you can't read the word, click here.


Latest updated pages