Forwarding a USB token (digital signature key) to a remote server
You cannot physically plug a USB token into a remote server — it sits in a data centre. But a token plugged into your computer can be forwarded into the session over the network, and software on the server will see it as though it were attached locally.
There are two approaches. Start with the first: it is simpler and costs nothing.
Method 1. Smart-card redirection built into RDP
Most signing tokens present to the system as smart cards, and smart-card redirection is built into Windows Remote Desktop. No extra software is needed.
On your computer
- Insert the token and confirm it works locally — your signing software can see the key.
- Press Win + R, type
mstscand press Enter. - Expand “Show Options” and open the “Local Resources” tab.
- Under “Local devices and resources”, click “More”.
- Tick “Smart cards”, click OK and connect to the server.
To avoid repeating this, save the connection as an .rdp file —
the setting is remembered. In the file itself it is the line
redirectsmartcards:i:1.
On the server
- Install the token drivers and your provider's signing software — the server needs them just as an ordinary computer would.
- Check that the Smart Card service (
SCardSvr) is running:services.msc→ “Smart Card” → startup type “Automatic”. - If the token does not appear, check group policy:
gpedit.msc→ Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection. The setting “Do not allow smart card device redirection” must be Disabled or Not Configured.
Once connected, open your signing software on the server — the key should be
detected. You can list readers from a command prompt with
certutil -scinfo.
Method 2. USB-over-IP for devices that are not smart cards
Some devices — software protection dongles (HASP, Guardant) and certain tokens with proprietary drivers — are not smart-card class. RDP's built-in redirection does not carry them: it forwards smart cards specifically, not arbitrary USB devices.
For those, USB-over-IP is used: a server component runs on your computer and publishes the USB port to the network, and a client on the remote server attaches the device to the system.
- usbipd-win — a free, open-source implementation of the USB/IP protocol for Windows. Requires installing the client on the server and opening the relevant firewall port.
- VirtualHere, USB Network Gate, Donglify — commercial products. Easier to set up and better with awkward devices, but they need a licence.
The sequence is the same in each case: install the server component on the machine holding the token, open the port, install the client component on the remote server, connect to your computer and attach the device.
What to keep in mind
- Your computer has to be switched on. The token stays physically with you, so the server can reach it only while your machine is running and connected. This approach does not suit unattended, scheduled signing.
- Drivers are needed on the server. Redirection delivers the device; installing the software that talks to it is up to you.
- Check your certificate provider's rules. Some qualified providers state explicitly whether a key may be used in a remote session. That is a policy question rather than a technical one.
- Security. While the token is forwarded, the server can ask it to sign. Only forward a key to servers you control, and unplug the token when it is not needed.
If it does not work
- Token not visible on the server — check the “Smart cards” box in the RDP client and make sure you reconnected after setting it.
- Device visible but the signing software cannot see it — most likely a missing driver or provider library on the server.
- The device is not a smart card at all (Device Manager lists it under another category) — move on to method 2.
If questions remain, contact support and we will help as far as server configuration goes.