- SmartcardServices-Users - lists.macosforge.org

Safari 5 broke my CAC card
by Michael Kluskens 24 Jun '10

24 Jun '10

Begin forwarded message: > Mac OS X 10.6.4 made NO changes to Smart Card Services. Check for > other issues on your system. With further testing I isolated the problem to the installation of Safari 5 on 10.6.3 or Safari 5 with 10.6.4, which introduced the pop- up dialog box for CAC certificate choosing, with Safari 5 I get one identity certificate followed by two or four email certificates, none of which works. I'm not the only one whose CAC card was broken by Safari 5, a co-worker in the Center of Computational Science also lost use of his CAC card when Safari 5 was installed on 10.6.3. 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) launch Safari 4.0.4 & connect to infosec.navy.mil, success 3) Software update including Safari 5 but excluding OS X 10.6.4 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) launch Safari 4.0.4 & connect to infosec.navy.mil, success 3) Software Update install Safari 5 only 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 6) Configure Mail with IMAP, check new message for encryption and signing - success 1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no extra languages, fonts, or printers 2) Connect to infosec.navy.mil, success 3) Software Update install OS X 10.6.4 only (includes Safari 5) 4) launch Safari 5, connect to infosec.navy.mil, FAILURE 5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully 6) Configure Mail with IMAP, check new message for encryption and signing - success I also tested my CAC card with my reader (SCRx31 FW 5.2.5) on my home iMac with 10.6.4 and Safari 5, failed there as well. For whatever reason, Safari 5 does not work with a Oberthbur ID One V5.2 Dual CAC card with a SCRx31 FW 5.25 reader. We confirmed that a co-worker's Oberthur CAC does not work with my reader on my machine, but his Oberthur CAC does work with his Omnicard reader on his machine. Michael Kluskens

2 2

sc_auth "CSSMERR_DL_MISSING_VALUE" error
by fakesexnoises 14 Jun '10

14 Jun '10

Hi, Running OS X 10.6.3, with OpenSC 0.12.0 from here: http://www.opensc-project.org/opensc/wiki/MacInstaller Using a PKCS11 Engine supplied by one of the OpenSC devs. Smart Card: Feitian PKI mini-SIM from gooze.eu Smart Card Reader: SCM SCR3320 Following the instructions here: http://www.gooze.eu/howto/smartcard-quickstarter-guide I've transferred a 2048-bit RSA private key and associate certificate to my new Smart Card. I've modifed the /etc/authorization file. Now I'm trying to run the sc_auth script to associate a user account to my Smart Card, and receiving the following error: security: SecKeychainSearchCopyNext: CSSMERR_DL_MISSING_VALUE I found the following thread at the Apple mailing lists: http://lists.apple.com/archives/fed-talk/2010/Feb/msg00058.html He's having an identical issue, ie. "the card shows up in the Keychain, but none of the certificates show up and the Keychain for it can't even be unlocked." He was advised to install CAC-NG Tokend (BETA v0.95) for Mac OS X 10.6. Does this advice apply in my case also? Thanks, S.

2 2

ECA Hardware Token - Certs not showing up in Keychain
by Bob Colbert 04 Jun '10

04 Jun '10

I just received an ECA Hardware Assurance certificate. It is a ActivIdentity USB Token as shown here - http://www.actividentity.com/products/authenticationdevices/USBTokens/ . I have the one without the one-time password display. Of course set up of the device and placing the certificates on it was done with ActivClient on Windows at the ECA facility. Got back to the office and installed the ActivClient in my Fusion virtual machine with XP. Verified the certs were there and have set it up such that Outlook can use them. Everything looks fine thus far. Details of the USB Token in the Windows ActivClient is the following: Manufacturer: Oberthur Model: CosmopolIC 64K V5.2 When I plug the device into the Mac (running Snow Leopard 10.6.3), the device shows up in the Keychain as a CAC-xxx entry. I double-click the lock and it prompts me for the PIN. I think it is unlocking because a windows pops up titled “Common Access Card” with two tabs for Identification and Benefits, none of which are populated because this isnt a CAC card. However, no certificates are displayed. I am selecting the “All Items” category in Keychain (and My Certificates/Certifcates category too) and still nothing is showing up. I think I am close, but maybe this device isnt fully supported? ---- Bob Colbert DE Technologies

2 2

SetIdentityPreference on OSX 10.4 Tiger
by Dann, Geoff CIV NAVFAC ESC, PW 21 May '10

21 May '10

I've grabbed the SetIdentityPreference program from http://smartcardservices.macosforge.org/trac/wiki/installers , and have a couple of questions: (1) SetIdentityPreference returns an error if I enter a URL that is a directory, like the one for NMCI OWA, "http://webmail.west.nmci.navy.mil/". (2) When run, SetIdentityPreference lists two email certificates to choose from, but both are "usage: wrap", and the one needed for NMCI Outlook Web Access (OWA) is "usage: encrypt, verify, wrap, derive", far as I know. I did get SetIdentityPreference to work with the newly-enabled Defense Travel System (DTS). The DTS URL ends in a file name, not in a slash. DTS wants to see the Identity (non-email) certificate. Possibly related factor: I have NMCI OWA working by using the AFCCertificateControl preference pane that Paul Nelson of Thursby posted close to two years ago. It's supposed to hide the Identity (non-email) certificate from applications so they'll use an email certificate. It contains a check-box to allow the non-email cert to be seen or not seen. The check-box doesn't seem to have an effect, so the only way now to have the identity (non-email) certificate seen is to uninstall the software. So to switch between NMCI-OWA and DTS I'd need to go through several hoops. Any ideas what I might be missing? Anyone else using Tiger still? Geoffrey Dann geoff.dann(a)navy.mil NAVFAC Engineering Service Center, ESC231 1100 23rd Ave, Port Hueneme CA 93043-4370 805-982-1366 / DSN-551-1366 / fax 805-982-5388 cell 805-901-6777

1 0

tokendPKCS11 not working w/ Firefox (all versions)
by Miller, Timothy J. 21 May '10

21 May '10

Hints appreciated. The browser returns sec_error_pkcs11_function_failed, which is a non-specific error. I pulled down a nightly for the NSS debugging, and find the following PKCS11 debug (full debug avail on request): -1334726656[28e8ea0]: C_OpenSession -1334726656[28e8ea0]: slotID = 0x0 -1334726656[28e8ea0]: flags = 0x4 -1334726656[28e8ea0]: pApplication = 0x3130e00 -1334726656[28e8ea0]: Notify = 0x2533919 -1334726656[28e8ea0]: phSession = 0xb071aacc -1334726656[28e8ea0]: *phSession = 0x2 -1334726656[28e8ea0]: rv = CKR_OK -1334726656[28e8ea0]: C_SignInit -1334726656[28e8ea0]: hSession = 0x2 -1334726656[28e8ea0]: pMechanism = 0xb071ab1c -1334726656[28e8ea0]: hKey = 0x5 -1334726656[28e8ea0]: mechanism = CKM_RSA_PKCS -1334726656[28e8ea0]: rv = CKR_OK -1334726656[28e8ea0]: C_Sign -1334726656[28e8ea0]: hSession = 0x2 -1334726656[28e8ea0]: pData = 0xb071abdc -1334726656[28e8ea0]: ulDataLen = 36 -1334726656[28e8ea0]: pSignature = 0x188ccc00 -1334726656[28e8ea0]: pulSignatureLen = 0xb071ab28 -1334726656[28e8ea0]: *pulSignatureLen = 0x80 -1334726656[28e8ea0]: rv = CKR_FUNCTION_FAILED Since the module loads and does everything else correctly (near as I can tell) I'm not positive this is a FF bug. However, I don't know if it's an Apple bug either, so I haven't opened one against SmartCardServices ... yet. I know others are having the same problem, but with recent fixes in 10.6 and Safari the use of FF with smartcards has declined a bit (or alternative PKCS11 modules are being used). Anyone else have an idea? -- Tim

1 0

Re: [SmartcardServices-Users] CCID drivers auto-start issues on the Snow Leopard
by Paul Babick 14 May '10

14 May '10

So...what is the corrective action when the Smart Card doesn't appear in the keychain even though pcscd is running and pcsctest is successful? Reader is SCR 3310 Card is Gemalto Gemalto Mac library dated 22 April 2010 installed.

2 1

Re: [SmartcardServices-Users] [Fed-Talk] DoD ECA Certificates - Hardware vs Software with the Mac
by Shawn A. Geddis 10 May '10

10 May '10

Bob, to add clarity to other comments made already.. All Smart Card questions, comments, feedback go to http://SmartCardServices.MacOSFOrge.Org/ mailing lists... On May 10, 2010, at 9:38 AM, Bob Colbert wrote: ... > Particulary, I am trying to understand the ECA certificate program for DoD contractors. I currently have a “software” certificate. All applications on Mac OS X interface to credential stores as "Keychains" (except legacy apps using PKCS#11). A Smart Card is simply a "Dynamic Keychain" - available only while the Smart Card is inserted. > I was looking to convert it to either USB or SmartCard. You would not exactly convert the Identity (Certificate / Private Key), but change the storage medium from File-based Keychain to a Hardware Token-based Keychain (Smart Card). It would be a "smart card" whether it was a plastic card or USB form factor -- Smart Card simply refers to the chip-based technology (referred to as "CHIP and PIN" in Europe). > The ECA program defines this as Medium Hardware Assurance or Token Hardware Assurance. The Medium one is supposedly the ECA equivalent of a CAC card, however I havent had any problems thus far just using my software certificates. But I really don’t fully understand the technical/everyday usage difference between Medium Hardware vs Token Hardware levels. Tim properly noted that the issue for you is not the device (smart card), but rather what profile (applet) is loaded onto the device. PIV & CAC are already there in Mac OS X (have been for years) and CACNG is currently in beta via MacOSForge. If you want the easiest path forward, your organization would pick a PIV-compliant smart card and hence would have out of the box support on both Mac OS X and Windows 7. > While contacting one of the 3 vendors approved for ECA certificate issuance, it was brought up that there is a “middleware” client required for use with either a USB-based or SmartCard device for either Medium Hardware or Token Hardware levels. I believe the client is ActivClient. I am not sure if this middleware is required for all 3 vendors or just this one and is the middleware client the same for all three vendors. "Middleware" is not required on Mac OS X for Smart Cards - it is built into the OS, however, your system needs a corresponding "Tokend" for each Smart Card "type". Apple provides CAC tokend / PIV tokend(among others) and many of the Smart Card vendors make a tokend available for their proprietary cards when needed by their customers. Again, this is specific to the card profile (applet) loaded onto the device. > My basic questions about the middleware are the following: > Is this middleware still required using Mac 10.6.3? Previous posts by Shawn Geddis from Apple seem to apply that everything is provided for within the Mac OS. see comments above. > The ECA vendor seemed to imply that the current version of ActivClient is not ready for Snow Leopard. I do not believe you will see a SL version of ActivClient > Does this middleware impact the logon process or just when I want to sign/encrypt emails? My understanding of its usage is that it is a holder of the 2 certificates that I currently have in a software-version. That I just have to inserted/authenticated during the creation/sending/reading of the emails. We have a mixed Mac/PC environment and I am not fully ready to implement that type of signon environment currently required with government CAC usage. I just want to use the certs for email encryption. As Time noted, what you want to use your Smart Card for is up to you. > Does this middleware interface properly with either Mac Mail or Microsoft Entourage or again, is this middleware redundant? Mail.app and Entourage properly interface via Keychains and hence any valid credentials available to your system -- File-based, Smart Card-based, Director Server-based, etc. Again, All Smart Card questions, comments, feedback go to http://SmartCardServices.MacOSFOrge.Org/ mailing lists... - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise

1 0

JITC CAC card gets " An untrusted certificate authority was detected while processing the smart card certificate used for authentication" login error...
by Paul Kwan 01 May '10

01 May '10

Hi All, I posted this message in the Fed-Talk forum accidentally. I should post it here. Here's my message: I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again: 1) From the Windows login screen, it pops up this error message: The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication 2) On the Mac, secure.log shows similar error message complaining on "An untrusted CA..." The JITC CAC card is valid until next year. And the DoD certs on AD are also valid: 2.1) "DOD OM CA-20": Valid from 8/3/2007 to 8/1/2013 2.2) "DOD OM EMAIL CA-20": Valid from 8/2/2007 to 4/1/2013 2.3) "DoD JITC Root CA 2": Valid from 7/14/2005 to 7/2/2030 3) I can access and download the CRL files without any problem: 3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20 Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance. PSK

2 3

Re: [SmartcardServices-Users] Problem with pcscd and GD card
by Francis Augusto Medeiros 09 Apr '10

09 Apr '10

To be quite honest, they are still trying to figure it out. It seems to me that their rep that was in charge of my issue will end up handling it to a higher level support. Francis On 09/04/2010, at 08:24, Chris Hauser wrote: > If SafeNet's Software or Installer broke a part of your system. > What's the statement from SafeNet? > > > Chris > > Am 08.04.2010 um 20:55 schrieb Francis Augusto Medeiros: > >> Shawn, >> >> It seems you got some of my points wrong. >> >> 1 - I didn't install TokenLounge. I should have and wanted to do so, but I was provided with SafeNet's Borderless PK Security for Mac, which caused the whole problem. >> >> 2 - How can I reinstall my Services and CCID so that I have things in the original state without having to reinstall the whole OS? >> >> I have another Mac where things are working fine. Are there files I could/should copy and replace mine on the corrupted system in an attempt to make it work? >> >> Yours, >> >> Francis > > > -- > This e-mail is digital signed. If your e-mail-application doesn't support > the verification of digital signatures, just ignore the signature-file. > > >

1 0

Problem with pcscd and GD card
by Francis Augusto Medeiros 09 Apr '10

09 Apr '10

Hi there folks, I have a Gemalto PCTwin usb smartcard reader, which I intended to use with my GD smartcard. My CA sent me a middleware called SafeSign 3.0, so I could use my smartcard on the Mac. Unfortunately, it just works with Firefox. I wanted something that would work with Keychain and standard Mac apps. So I asked them if they had TokenLounge, which is AET's tokend for Mac. They sent me something else, called Safenet Borderless Security PK for Mac. It didn't work on my Mac 10.6.3 install, and precluded my newer SafeSign to work. So I uninstalled it. Now my card can't be read on my Mac! I tested it under Windows and on another mac, and it works there. So, doing some research, I found out that my pcscd is not running, and I can't make it run. When I try to run it typing pcscd -f, I get this: User signal 2 And when typing sudo pcscd -df I get this: /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/debuglog.c:240:DebugLogSetLevel() debug level=debug /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/pcscdaemon.c:389:main() pcscd set to foreground with debug send to stderr /SourceCache/SmartCardServices/SmartCardServices-36160/src/PCSC/readerfactory.c:1545:ReaderCheckArchitecture() Send respawn signal to pcscd (pid=794) User signal 2 Is there any clue on how can I get things back working again? Yours, Francis -- -------------------------------------------------------------------- Francis Augusto Medeiros ICQ:7825595 Skype: francisaugusto AIM/iChat: francisaugusto Vitória da Conquista - Bahia - Brasil "Lâmpada para os meus pés é a Tua palavra, e luz para o meu caminho" --- Salmo 119:105 --------------------------------------------------------------------

4 8