title: YubiHSM Code-signing exporting certificate
body: <p>I followed the tutorial for generating a code-signing certificate using the YubiHSM Key Storage provider available <a href="https://developers.yubico.com/YubiHSM2/Component_Reference/KSP/Code_Signing_Example.html" rel="nofollow noreferrer">here</a>. After creating the Certificate Signing Request (CSR) with <code>certreq -new sign.inf sign.req</code> a new asymmetric key is created in the YubiHSM together with an association between this key and the certificate in the YubiHSM Key Storage Provider (KSP). After that, I am able to sign my binaries using something like <code>signtool sign /sha1 &lt;certificate hash&gt; &lt;binary name&gt;</code>.</p>
  <p>However, when I export this certificate and import it to a different machine the certificate does not have an associated private key. Typing <code>certutil -repairstore my &lt;certificate hash&gt;</code> does not help. As far as I understand, the KSP only stores a link to the YubiHSM, not the actual private key itself. So I suppose I need to somehow create this association in the KSP.</p>