Why smartcard reader drivers matter

Every command ultimately passes through the smartcard reader and its device driver before reaching the smartcard.

Modern smartcard communication makes greater use of direct communication paths to the smartcard. Supported versions of Smartcard Connect (version 4 and above) and the Signing API support multiple communication methods, depending on the smartcard type and the operation being performed.

As a result, the quality and capability of the underlying reader driver have a greater influence on the reliability and performance of authentication and signing operations. Installing the manufacturer's original equipment manufacturer (OEM) driver is strongly recommended wherever one is available.

Series 9 and 10 smartcards

For PIV-enabled smartcards, authentication and signing operations utilise the card supplier's dedicated PIV API, providing a standards-based interface for communicating with the card.

Series 8 smartcards

For older smartcards, authentication is performed using direct APDU (Application Protocol Data Unit) commands, with cryptographic operations such as digital signing continuing to use established interfaces where required. This modern approach improves interoperability while maintaining compatibility with existing integrations.

Windows includes a generic CCID smartcard reader driver that provides broad compatibility across many readers. This driver allows many readers to function correctly, but it may not include hardware-specific optimisations or the latest fixes provided by the reader manufacturer.

OEM drivers are developed specifically for the reader hardware and may provide:

• improved communication stability
• better compatibility with supported smartcards
• enhanced error handling
• improved performance
• support for firmware enhancements and hardware-specific features
• ongoing fixes provided by the hardware manufacturer

If the driver does not fully support the reader hardware or does not correctly implement the relevant smartcard communication standards, organisations may experience:

• intermittent card detection issues
• authentication failures
• communication timeouts
• delayed responses when accessing certificates
• failed smartcard operations
• reduced reliability under normal day-to-day use

For these reasons, organisations should install the latest supported OEM driver whenever possible.

After installing an OEM smartcard reader driver, it's important to confirm that Windows is using the correct driver.

To verify the installed driver:

1. Open Device Manager
2. Expand Smart card readers
3. Locate your smartcard reader
4. Right-click the reader and select Properties
5. Select the Driver tab

Confirm that:

• Driver Provider identifies the smartcard reader manufacturer
• Driver Version matches the version supplied by the manufacturer
• Driver Date corresponds to the installed driver package

If the Driver Provider displays Microsoft, Windows may still be using the generic CCID driver rather than the manufacturer's OEM driver.

If this occurs after installing the OEM driver, check that:

• you installed the correct driver package for the smartcard reader model
• the driver supports your version of Windows
• Windows has successfully associated the OEM driver with the reader hardware
• no newer driver supplied through Windows Update has replaced the OEM driver

If necessary, consult the smartcard reader manufacturer's documentation for guidance on manually selecting the correct driver.

Important: installing an OEM driver package does not necessarily mean that Windows will use the manufacturer's smartcard reader driver. Always verify the Driver Provider, Driver Version and Driver Details in Device Manager to confirm that the reader is configured as intended by the hardware manufacturer.

Some computer manufacturers use Microsoft's built-in USB CCID Smartcard Reader (WUDF) driver as the primary smartcard reader driver, while providing additional manufacturer-specific drivers and components that enable or enhance the functionality of the integrated reader.

For example, Dell laptops use the Microsoft USB CCID Smartcard Reader (WUDF) driver by design, with supporting functionality provided through Dell components such as ControlVault and associated system drivers. In these cases, the Microsoft driver is expected and does not indicate an incorrect installation.

Always refer to the computer or smartcard reader manufacturer's guidance to determine the recommended driver configuration for your hardware. Where required, ensure that all supporting OEM drivers and firmware are installed and kept up to date.

If you are using existing third-party software that integrates with the current Signing API, you should continue to install the required middleware in accordance with the software supplier's guidance. This includes the installation of any required smartcard middleware as per our guidance on how to set up a CIS2 smartcard workstation.

This ensures compatibility with existing integrations while allowing organisations to benefit from improvements to Smartcard Connect.

To achieve the highest levels of reliability, we recommend that organisations:

• install the latest OEM smartcard reader driver supplied by the reader manufacturer
• keep smartcard reader firmware up to date where supported
• make sure smartcard readers and drivers are supported for the version of Windows being deployed
• validate reader drivers as part of desktop build and operating system upgrade testing
• continue to install any middleware required by existing third-party applications and integrations