1

When I run p11tool --list-tokens on Ubuntu 17 the certificates from my USB connected Sitecom smart card reader don't show up in the results. I was hoping to use p11tool to get the URL of the certificate I need to use to connect to my company's VPN using OpenConnect.

Card state: Card inserted, Shared Mode

.. and it responds immediately when I take the card out by telling me:

Card state: Card removed

  • I installed opensc and opensc-pkcs11 (https://github.com/OpenSC/OpenSC/wiki). I have two opensc.module files on my system, because I wasn't sure where to put them:

    /etc/pkcs11/modules/opensc.module

    /usr/share/p11-kit/modules/opensc.module

Both files' contents are the same:

module:/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so

I verified that opensc-pksc11.so exists.

Any idea where to go from here? My smart card isn't listed in the output from p11tool --list-tokens, so I can't get the certificate URL that I need to connect to the VPN using OpenConnect. Output from p11tool:

Token 0:
    URL: pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
    Label: System Trust
    Type: Trust module
    Manufacturer: PKCS#11 Kit
    Model: p11-kit-trust
    Serial: 1
    Module: p11-kit-trust.so


Token 1:
    URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aSSH%3aHOME;token=SSH%20Keys
    Label: SSH Keys
    Type: Generic token
    Manufacturer: Gnome Keyring
    Model: 1.0
    Serial: 1:SSH:HOME
    Module: gnome-keyring-pkcs11.so


Token 2:
    URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aSECRET%3aMAIN;token=Secret%20Store
    Label: Secret Store
    Type: Generic token
    Manufacturer: Gnome Keyring
    Model: 1.0
    Serial: 1:SECRET:MAIN
    Module: gnome-keyring-pkcs11.so


Token 3:
    URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aUSER%3aDEFAULT;token=Gnome2%20Key%20Storage
    Label: Gnome2 Key Storage
    Type: Generic token
    Manufacturer: Gnome Keyring
    Model: 1.0
    Serial: 1:USER:DEFAULT
    Module: gnome-keyring-pkcs11.so


Token 4:
    URL: pkcs11:model=1.0;manufacturer=Gnome%20Keyring;serial=1%3aXDG%3aDEFAULT;token=User%20Key%20Storage
    Label: User Key Storage
    Type: Generic token
    Manufacturer: Gnome Keyring
    Model: 1.0
    Serial: 1:XDG:DEFAULT
    Module: gnome-keyring-pkcs11.so

Below is th output of lsusb. When I remove the card reader from the USB port the Realtek Semiconductor entry disappears, so I assume the card reader is recognized by the OS. However, I am not sure why it is called "Realtek" since it is a Sitecom reader, but I assume Realtek is just the chip manufacturer. Also, it is not a Storage Device. When I use the card on Windows it will sometimes try to assign a drive letter to the card and access it, which fails. Maybe the card reader inaccurately reports it is a storage device?

me@me:/etc/pkcs11/modules$ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 8087:0a2b Intel Corp. 
Bus 001 Device 003: ID 0bda:0169 Realtek Semiconductor Corp. Mass Storage Device
Bus 001 Device 005: ID 1bcf:2b95 Sunplus Innovation Technology Inc. 
Bus 001 Device 002: ID 046d:c52f Logitech, Inc. Unifying Receiver
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.