When I run
p11tool --list-tokens on Ubuntu 17 the certificates from my USB connected Sitecom smart card reader don't show up in the results. I was hoping to use p11tool to get the URL of the certificate I need to use to connect to my company's VPN using OpenConnect.
- I am confident the card reader is detected and works. I used the PCSC-lite and CCID open source drivers from https://pcsclite.alioth.debian.org/. When I use their verification tool (PCSC-perl) it shows me
Card state: Card inserted, Shared Mode
.. and it responds immediately when I take the card out by telling me:
Card state: Card removed
I installed opensc and opensc-pkcs11 (https://github.com/OpenSC/OpenSC/wiki). I have two opensc.module files on my system, because I wasn't sure where to put them:
Both files' contents are the same:
I verified that opensc-pksc11.so exists.
Any idea where to go from here? My smart card isn't listed in the output from
p11tool --list-tokens, so I can't get the certificate URL that I need to connect to the VPN using OpenConnect. Output from p11tool:
Token 0: URL: pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust Label: System Trust Type: Trust module Manufacturer: PKCS#11 Kit Model: p11-kit-trust Serial: 1 Module: p11-kit-trust.so Token 1: URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aSSH%3aHOME;token=SSH%20Keys Label: SSH Keys Type: Generic token Manufacturer: Gnome Keyring Model: 1.0 Serial: 1:SSH:HOME Module: gnome-keyring-pkcs11.so Token 2: URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aSECRET%3aMAIN;token=Secret%20Store Label: Secret Store Type: Generic token Manufacturer: Gnome Keyring Model: 1.0 Serial: 1:SECRET:MAIN Module: gnome-keyring-pkcs11.so Token 3: URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aUSER%3aDEFAULT;token=Gnome2%20Key%20Storage Label: Gnome2 Key Storage Type: Generic token Manufacturer: Gnome Keyring Model: 1.0 Serial: 1:USER:DEFAULT Module: gnome-keyring-pkcs11.so Token 4: URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aXDG%3aDEFAULT;token=User%20Key%20Storage Label: User Key Storage Type: Generic token Manufacturer: Gnome Keyring Model: 1.0 Serial: 1:XDG:DEFAULT Module: gnome-keyring-pkcs11.so
Below is th output of
lsusb. When I remove the card reader from the USB port the Realtek Semiconductor entry disappears, so I assume the card reader is recognized by the OS. However, I am not sure why it is called "Realtek" since it is a Sitecom reader, but I assume Realtek is just the chip manufacturer. Also, it is not a Storage Device. When I use the card on Windows it will sometimes try to assign a drive letter to the card and access it, which fails. Maybe the card reader inaccurately reports it is a storage device?
me@me:/etc/pkcs11/modules$ lsusb Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub Bus 001 Device 004: ID 8087:0a2b Intel Corp. Bus 001 Device 003: ID 0bda:0169 Realtek Semiconductor Corp. Mass Storage Device Bus 001 Device 005: ID 1bcf:2b95 Sunplus Innovation Technology Inc. Bus 001 Device 002: ID 046d:c52f Logitech, Inc. Unifying Receiver Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub