Looks like I have had some success.
The Journey begins
So, we start off with the "Middleware for Linux" LuxTrust page which basically says "You are on your own, we don't support you, and if it goes pear-shaped, it's all your own damn fault. Clicksign here!":
We shall remain unfazed and first make sure that Java is active in the browser.
Activate Java
If Java is not active, the Status Test Page (reachable via "Support" > "Questions about Certificate management" > "My Certificate" (in the footer) > "Test & Status") will look like this (note that the page also classifies Firefox 37 as "unsupported", which is frankly weird):
Install the Oracle Java SDK or Java Runtime from Oracle's website
Make the Java browser plugin visible to Firefox. See Manual Installation and Registration of Java Plugin for Linux, but the procedure is generally as follows (run as a non-root user):
$ mkdir ~/.mozilla/plugins
$ cd ~/.mozilla/plugins/
$ ln -s $PATH_TO_WHERE_JAVA_HAS_BEEN_INSTALLED/jre/lib/amd64/libnpjp2.so
Now one has to check whether Java is enabled in the browser.
See Oracle: How do I enable Java in my web browser? and Mozilla: How to turn off Java applets in Firefox. In principle you need just check the "≡ > Add-Ons" menu. Set to "Ask to activate" in order to stay on the "I'm in the loop here!" side of things:
If you have NoScript installed, make NoScript allows Java applets to run:
Finally test at Oracle's test page.
Ok, so that's that.
Install "LuxTrust Middleware"
So, you decided to install that "middleware RPM" called LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm that you downloaded from LuxTrust.
Let's get some info on this:
# rpm --query --info --package LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm
Name : libclassicclient
Epoch : 0
Version : 7.0.0
Release : b01.fc20
Architecture: x86_64
Install Date: (not installed)
Group : System Environment/Libraries
Size : 23147060
License : Proprietary
Signature : (none)
Source RPM : libclassicclient-7.0.0-b01.fc20.src.rpm
Build Date : Mon 08 Dec 2014 09:21:51 CET
Build Host : localhost
Relocations : (not relocatable)
Vendor : Gemalto
Summary : Classic Client for Linux: PKCS#11 token for Gemalto Classic cards
Description : PKCS#11 token for Gemalto Classic cards
Note the name libclassicclient. This indicates this is actually (a part of?) the "Gemalto Classic Client". It must be this one:
Also, the license is "proprietary". Oh well.
What does this package require? Quite a few things, actually. In particular, crypto libraries. Note that it doesn't need "sqlite" ....
# rpm --query --package --requires LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm
/bin/sh
/bin/sh
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(CompressedFileNames) <= 3.0.4-1
ld-linux-x86-64.so.2()(64bit)
ld-linux-x86-64.so.2(GLIBC_2.3)(64bit)
libatk-1.0.so.0()(64bit)
libcairo.so.2()(64bit)
libcrypto.so.10()(64bit)
libc.so.6()(64bit)
libc.so.6(GLIBC_2.14)(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libc.so.6(GLIBC_2.3.2)(64bit)
libc.so.6(GLIBC_2.3.3)(64bit)
libc.so.6(GLIBC_2.3.4)(64bit)
libc.so.6(GLIBC_2.3)(64bit)
libc.so.6(GLIBC_2.4)(64bit)
libc.so.6(GLIBC_2.7)(64bit)
libdl.so.2()(64bit)
libdl.so.2(GLIBC_2.2.5)(64bit)
libfontconfig.so.1()(64bit)
libfreetype.so.6()(64bit)
libgcc_s.so.1()(64bit)
libgcc_s.so.1(GCC_3.0)(64bit)
libgcc_s.so.1(GCC_3.3)(64bit)
libgcc_s.so.1(GCC_4.2.0)(64bit)
libgdk_pixbuf-2.0.so.0()(64bit)
libgdk-x11-2.0.so.0()(64bit)
libgio-2.0.so.0()(64bit)
libglib-2.0.so.0()(64bit)
libgobject-2.0.so.0()(64bit)
libgtk-x11-2.0.so.0()(64bit)
libidkit.so.2()(64bit)
libiomp5.so()(64bit)
libm.so.6()(64bit)
libm.so.6(GLIBC_2.2.5)(64bit)
libpango-1.0.so.0()(64bit)
libpangocairo-1.0.so.0()(64bit)
libpangoft2-1.0.so.0()(64bit)
libpcsclite.so.1()(64bit)
libpthread.so.0()(64bit)
libpthread.so.0(GLIBC_2.2.5)(64bit)
libpthread.so.0(GLIBC_2.3.2)(64bit)
libQtCore.so.4()(64bit)
libQtGui.so.4()(64bit)
librt.so.1()(64bit)
librt.so.1(GLIBC_2.2.5)(64bit)
libScanAPI.so()(64bit)
libssl.so.10()(64bit)
libstdc++.so.6()(64bit)
libstdc++.so.6(GLIBCXX_3.4.11)(64bit)
libstdc++.so.6(GLIBCXX_3.4.15)(64bit)
libstdc++.so.6(GLIBCXX_3.4)(64bit)
libstdc++.so.6(GLIBCXX_3.4.9)(64bit)
libusb-0.1.so.4()(64bit)
rpmlib(PayloadIsXz) <= 5.2-1
Ok, let's install the package as root:
# rpm --install LuxTrust_Middleware_Fedora_64bit_7.0.0-b01.rpm
WARNING: libsqlite3.so could not be found. Creating symbolic link...
Creating symbolic link done.
So it actually needs "sqlite", but doesn't say so in the requirements.
Googling the message above reveals that this message is indeed sometimes emitted by the "Gemalto Classic Client".
We now find an additional symbolic link in the filesystem:
/usr/lib/debug/usr/lib64/libsqlite3.so -> libsqlite3.so.0.8.6.debug
I guess we can live with that.
We got manuals
Listing the files installed via
# rpm --query --list libclassicclient | less
shows this package ACTUALLY COMES WITH (pretty good) MANUALS!
/usr/share/doc/libclassicclient/Classic_Client_Linux_User_Guide.pdf
/usr/share/doc/libclassicclient/ReleaseNotes.pdf
Excellent!
By reading the above, we quickly find out that:
- Something like a smartcard-reading daemon is needed, and it is
called
ccid something something. More details at Gemalto
- There is a packaged application to change the PIN on the "LuxTrust
signing stick" (as said, a GemPlus smartcard reader):
/usr/bin/CCChangePinTool
Install daemon, exercise CCChangePinTool
Plug in the "signing stick" at some USB port. The kernel log (journalctl SYSLOG_FACILITY=0) says:
kernel: usb 3-2: new full-speed USB device number 3 using ohci-pci
kernel: usb 3-2: New USB device found, idVendor=08e6, idProduct=3438
kernel: usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
kernel: usb 3-2: Product: USB SmartCard Reader
kernel: usb 3-2: Manufacturer: Gemplus
Let's install that smartcard-reading daemon:
# yum search ccid
pcsc-lite-ccid.x86_64 : Generic USB CCID smart card reader driver
pcsc-lite-ccid-debuginfo.x86_64 : Debug information for package pcsc-lite-ccid
libykneomgr.i686 : YubiKey NEO CCID Manager C Library
libykneomgr.x86_64 : YubiKey NEO CCID Manager C Library
It seems to be the pcsc-lite-ccid. Thus:
# yum install pcsc-lite-ccid
Installing : pcsc-lite-1.8.10-2.fc20.x86_64
Installing : pcsc-lite-ccid-1.4.13-1.fc20.x86_64
Some additional output elided. Now start the daemon:
# systemctl start pcscd
# systemctl status pcscd
pcscd.service - PC/SC Smart Card Daemon
Loaded: loaded (/usr/lib/systemd/system/pcscd.service; static)
Active: active (running) since Mon 2015-04-06 13:12:43 CEST; 4s ago
Main PID: 10970 (pcscd)
CGroup: /system.slice/pcscd.service
└─10970 /usr/sbin/pcscd --foreground --auto-exit
systemd[1]: Started PC/SC Smart Card Daemon.
pcscd[10970]: 00000000 utils.c:61:GetDaemonPid() Can't open /var/run/pcscd/pcscd.pid: No such file or directory
pcscd[10970]: 00062795 commands.c:898:CmdEscape error on byte 10
Basically not looking bad.
Now run /usr/bin/CCChangePinTool as non-root user.
A window appears that allows you to "change the PIN". Set the PIN to its existing value (be double careful here!). Apparently this works, the application does not complain or segfault. Cool.
Make smartcard reader visible to Firefox
(This all comes from the Gemalto Manual not provided by LuxTrust)
One has to explicitly configure the smartcard reader in Firefox. Here is how:
Under Preferences > Ribbon: "Advanced" > Tab: "Certificates" > Button: "Security Devices" you have to add the smartcard reader and its smartcard. This may be arbitrary.
In my case, the reader showed up first:
But after some time (in particular, after the PIN non-change above), the "Gemalto USB Shell Token V2" is recognized:
But after a FireFox restart the label had changed:
Mysterious? Yes! But you can now "Load" the "GemP15-1". This demands entering the PIN to the smartcard (which keep safely in a notebook or in LastPass...)
Test at LuxTrust
So let's go back to the LuxTrust test page and....
Well, it STILL does not work. No idea why even though this is a Java Applet that could log what's going on and where exactly it is encountering problems.
Is it time for Mr. Rage yet?
Test at RCSL
The Company Registry of Luxembourg (RCSL) can be used for another test. They have a "certificate login page". Bring it up, you get an "eAccess" page ("Connection to an online service of the State of Luxembourg"), which loads an Applet published by CTIE - Centre des technologies de l'information de l'Etat. If you are fast enough and click on the "Run" button, you will notice that the Applet can properly access the LuxTrust Signing Stick and will retrieve the user's coordinates for the login page.
It works! Enjoy.
