JITC CAC card gets " An untrusted certificate authority was detected while processing the smart card certificate used for authentication" login error...
Hi All, I posted this message in the Fed-Talk forum accidentally. I should post it here. Here's my message: I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again: 1) From the Windows login screen, it pops up this error message: The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication 2) On the Mac, secure.log shows similar error message complaining on "An untrusted CA..." The JITC CAC card is valid until next year. And the DoD certs on AD are also valid: 2.1) "DOD OM CA-20": Valid from 8/3/2007 to 8/1/2013 2.2) "DOD OM EMAIL CA-20": Valid from 8/2/2007 to 4/1/2013 2.3) "DoD JITC Root CA 2": Valid from 7/14/2005 to 7/2/2030 3) I can access and download the CRL files without any problem: 3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20 Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance. PSK
Paul, Note that the Root Cert "DoD JITC Root CA 2" is not part of the "System Root" (immutable Root Store) and hence would require that you enable trust for that Root CA - Mac OS X requires administrative trust set for Anchors not pre-shipped by Apple. To be more accurate, you can set the Trust Anchor to be any Cert within the Trust Path, since Mac OS X support a multi-tiered Trust Model. You can accomplish this via the CLI security command or of course via the GUI of Keychain Access. security add-trusted-cert [<options>] [certFile] Usage: add-trusted-cert [<options>] [certFile] -d Add to admin cert store; default is user -r resultType resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot -p policy Specify policy constraint (ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap) -a appPath Specify application constraint -s policyString Specify policy-specific string -e allowedError Specify allowed error (certExpired, hostnameMismatch) or integer -u keyUsage Specify key usage, an integer -k keychain Specify keychain to which cert is added -i settingsFileIn Input trust settings file; default is user domain -o settingsFileOut Output trust settings file; default is user domain -D Add default setting instead of per-cert setting certFile Certificate(s) When you click on and view the certificates in Keychain Access, the Status of the Certificate is displayed in the header area. If it is as I suspect, you will see "This certificate was signed by an untrusted issuer". -Shawn __________________________________________________ Shawn Geddis geddis@mac.com Security Consulting Engineer geddis@apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________ On Apr 6, 2010, at 9:23 AM, Paul Kwan wrote:
Hi All,
I posted this message in the Fed-Talk forum accidentally. I should post it here. Here’s my message:
I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again:
1) From the Windows login screen, it pops up this error message:
The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication
2) On the Mac, secure.log shows similar error message complaining on “An untrusted CA...”
The JITC CAC card is valid until next year. And the DoD certs on AD are also valid:
2.1) “DOD OM CA-20”: Valid from 8/3/2007 to 8/1/2013 2.2) “DOD OM EMAIL CA-20”: Valid from 8/2/2007 to 4/1/2013 2.3) “DoD JITC Root CA 2”: Valid from 7/14/2005 to 7/2/2030
3) I can access and download the CRL files without any problem:
3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20
Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance.
PSK
Hi Shawn, The odd part of this is that I have this working since last May with the Mac and Windows. Now both don't work with the same error. I am sure I didn't have to do the security command before. I'll try this next on the Mac. Thanks. PSK On 4/8/10 1:41 AM, "Shawn A. Geddis" <geddis@mac.com> wrote: Paul, Note that the Root Cert "DoD JITC Root CA 2" is not part of the "System Root" (immutable Root Store) and hence would require that you enable trust for that Root CA - Mac OS X requires administrative trust set for Anchors not pre-shipped by Apple. To be more accurate, you can set the Trust Anchor to be any Cert within the Trust Path, since Mac OS X support a multi-tiered Trust Model. You can accomplish this via the CLI security command or of course via the GUI of Keychain Access. security add-trusted-cert [<options>] [certFile] Usage: add-trusted-cert [<options>] [certFile] -d Add to admin cert store; default is user -r resultType resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot -p policy Specify policy constraint (ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap) -a appPath Specify application constraint -s policyString Specify policy-specific string -e allowedError Specify allowed error (certExpired, hostnameMismatch) or integer -u keyUsage Specify key usage, an integer -k keychain Specify keychain to which cert is added -i settingsFileIn Input trust settings file; default is user domain -o settingsFileOut Output trust settings file; default is user domain -D Add default setting instead of per-cert setting certFile Certificate(s) When you click on and view the certificates in Keychain Access, the Status of the Certificate is displayed in the header area. If it is as I suspect, you will see "This certificate was signed by an untrusted issuer". -Shawn __________________________________________________ Shawn Geddis geddis@mac.com Security Consulting Engineer geddis@apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________ On Apr 6, 2010, at 9:23 AM, Paul Kwan wrote: Hi All, I posted this message in the Fed-Talk forum accidentally. I should post it here. Here's my message: I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again: 1) From the Windows login screen, it pops up this error message: The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication 2) On the Mac, secure.log shows similar error message complaining on "An untrusted CA..." The JITC CAC card is valid until next year. And the DoD certs on AD are also valid: 2.1) "DOD OM CA-20": Valid from 8/3/2007 to 8/1/2013 2.2) "DOD OM EMAIL CA-20": Valid from 8/2/2007 to 4/1/2013 2.3) "DoD JITC Root CA 2": Valid from 7/14/2005 to 7/2/2030 3) I can access and download the CRL files without any problem: 3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20 Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance. PSK
Hi Shawn, I wanted to close this thread. As soon as I get the correct URL from DISA to download and install the latest root certs to my CA host, everything's back to normal. I don't need touch anything on the Mac side. Thanks for the help from you and all the forum people who responded. Cheers. PSK On 4/8/10 7:20 AM, "Paul Kwan" <paul.kwan@centrify.com> wrote: Hi Shawn, The odd part of this is that I have this working since last May with the Mac and Windows. Now both don't work with the same error. I am sure I didn't have to do the security command before. I'll try this next on the Mac. Thanks. PSK On 4/8/10 1:41 AM, "Shawn A. Geddis" <geddis@mac.com> wrote: Paul, Note that the Root Cert "DoD JITC Root CA 2" is not part of the "System Root" (immutable Root Store) and hence would require that you enable trust for that Root CA - Mac OS X requires administrative trust set for Anchors not pre-shipped by Apple. To be more accurate, you can set the Trust Anchor to be any Cert within the Trust Path, since Mac OS X support a multi-tiered Trust Model. You can accomplish this via the CLI security command or of course via the GUI of Keychain Access. security add-trusted-cert [<options>] [certFile] Usage: add-trusted-cert [<options>] [certFile] -d Add to admin cert store; default is user -r resultType resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot -p policy Specify policy constraint (ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap) -a appPath Specify application constraint -s policyString Specify policy-specific string -e allowedError Specify allowed error (certExpired, hostnameMismatch) or integer -u keyUsage Specify key usage, an integer -k keychain Specify keychain to which cert is added -i settingsFileIn Input trust settings file; default is user domain -o settingsFileOut Output trust settings file; default is user domain -D Add default setting instead of per-cert setting certFile Certificate(s) When you click on and view the certificates in Keychain Access, the Status of the Certificate is displayed in the header area. If it is as I suspect, you will see "This certificate was signed by an untrusted issuer". -Shawn __________________________________________________ Shawn Geddis geddis@mac.com Security Consulting Engineer geddis@apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________ On Apr 6, 2010, at 9:23 AM, Paul Kwan wrote: Hi All, I posted this message in the Fed-Talk forum accidentally. I should post it here. Here's my message: I have a test JITC CAC card that worked on Mac and Windows workstations since May last year. Now I got the following error when trying to login again: 1) From the Windows login screen, it pops up this error message: The system could not log you on. An untrusted certificate authority was detected while processing the smart card certificate used for authentication 2) On the Mac, secure.log shows similar error message complaining on "An untrusted CA..." The JITC CAC card is valid until next year. And the DoD certs on AD are also valid: 2.1) "DOD OM CA-20": Valid from 8/3/2007 to 8/1/2013 2.2) "DOD OM EMAIL CA-20": Valid from 8/2/2007 to 4/1/2013 2.3) "DoD JITC Root CA 2": Valid from 7/14/2005 to 7/2/2030 3) I can access and download the CRL files without any problem: 3.1) http://crl.nit.disa.mil/getcrl?DoD JITC Root CA 2 3.2) http://crl.nit.disa.mil/getcrl?DOD OM CA-20 3.3) http://crl.nit.disa.mil/getcrl?DOD OM EMAIL CA-20 Does anybody out there see the similar problem? How can I fix this so that my test JITC CAC card works again? Thanks for the help in advance. PSK
participants (2)
-
Paul Kwan
-
Shawn A. Geddis