[SmartcardServices-Users] Safari 5 broke my CAC card

[Michael Kluskens]

Begin forwarded message:

> Mac OS X 10.6.4 made NO changes to Smart Card Services.  Check for  
> other issues on your system.

With further testing I isolated the problem to the installation of  
Safari 5 on 10.6.3 or Safari 5 with 10.6.4, which introduced the pop- 
up dialog box for CAC certificate choosing, with Safari 5 I get one  
identity certificate followed by two or four email certificates, none  
of which works.  I'm not the only one whose CAC card was broken by  
Safari 5, a co-worker in the Center of Computational Science also lost  
use of his CAC card when Safari 5 was installed on 10.6.3.

1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no  
extra languages, fonts, or printers
2) launch Safari 4.0.4 & connect to infosec.navy.mil, success
3) Software update including Safari 5 but excluding OS X 10.6.4
4) launch Safari 5, connect to infosec.navy.mil, FAILURE
5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully

1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no  
extra languages, fonts, or printers
2) launch Safari 4.0.4 & connect to infosec.navy.mil, success
3) Software Update install Safari 5 only
4) launch Safari 5, connect to infosec.navy.mil, FAILURE
5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully
6) Configure Mail with IMAP, check new message for encryption and  
signing - success

1) Clean install of OS X 10.6.3 (build 10D575), no data migration, no  
extra languages, fonts, or printers
2) Connect to infosec.navy.mil, success
3) Software Update install OS X 10.6.4 only (includes Safari 5)
4) launch Safari 5, connect to infosec.navy.mil, FAILURE
5) launch Safari 4.0.4 from base OS X 10.6.3, connects successfully
6) Configure Mail with IMAP, check new message for encryption and  
signing - success

I also tested my CAC card with my reader (SCRx31 FW 5.2.5) on my home  
iMac with 10.6.4 and Safari 5, failed there as well.

For whatever reason, Safari 5 does not work with a Oberthbur ID One  
V5.2 Dual CAC card with a SCRx31 FW 5.25 reader.  We confirmed that a  
co-worker's Oberthur CAC does not work with my reader on my machine,  
but his Oberthur CAC does work with his Omnicard reader on his machine.

Michael Kluskens