Windows does not look for keys in PKCS#11. It looks in the certificate store, and reaches hardware through CryptoAPI and CNG. So the question on Windows is never “does it support PKCS#11” but “does the certificate show up in certmgr”.
The minidriver is what makes it show up
The device presents the standard USB CCID smart-card reader class, so Windows binds its own inbox driver with nothing to install. OpenSC’s minidriver then surfaces the token as a smart card, and any certificate on it appears in the personal store with its private key marked as living on hardware.
From that point everything that consumes the Windows store consumes this: signtool for Authenticode, Outlook for S/MIME, desktop PDF signers, IIS for a TLS binding, and smart-card logon if you are set up for it. None of them need to know what the device is.
Getting a certificate onto the token
Two routes. Generate the key on the card and produce a CSR with pkcs11-tool and OpenSSL, then import the issued certificate back onto the token — this is the route to prefer, because the key is created in hardware and never exists anywhere else. Or enrol through Windows itself against an enterprise CA using a certificate template that requires the smart-card KSP, which puts the key on the token as part of enrolment.
One thing to check before you plan around it
Using token keys from the Windows store is the well-trodden path. Running an Active Directory Certificate Services CA whose own key lives on the token is a different question: ADCS selects a CSP or KSP at installation, and the smart-card KSP route works but is not how ADCS is usually deployed. If that is your plan, prove it in a lab before you commit — and note that an ADCS issuing CA is also the kind of high-rate signer discussed on the EJBCA page, where a USB device is the wrong shape.
Where to go next
Windows is the platform where the store, not the API, is the thing to get right. See also code signing, document signing, Java keystores, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
