scdaemon is missing
GnuPG 2 connects to the card through gpg-agent, which again does not include smart card capabilities, but accesses them through another application. This can be configured and has a system-dependent default, from man gpg-agent:
Use program filename as the Smartcard daemon. The default is
Using the --export flag was the key (Thanks for the tip, @Johan Myréen). Thus, to see the cert's details and fingerprints, this works:
p11tool --export <certurl> | openssl x509 -text -noout
p11tool --export <certurl> | openssl x509 -fingerprint -noout #defaults to SHA1 fingerprint
p11tool --export <certurl> | openssl x509 -fingerprint -...
As it turns out, the gpg-agent process started by X doesn't load the right configuration file and therefore doesn't enable SSH support, which breaks things. Here's the file as provided by the gpg-agent DEB package:
Looks like I have had some success.
The Journey begins
So, we start off with the "Middleware for Linux" LuxTrust page which basically says "You are on your own, we don't support you, and if it goes pear-shaped, it's all your own damn fault. Clicksign here!":
We shall remain unfazed and first make sure that Java is active in the browser.
I just added this device on the list of devices for my CCID driver.
Use the current git version of the supported_readers.txt file, (re)install the CCID driver and your device should be available by OpenSC.
The message from opensc-tool --list-readers indicates the reader is present and sees the card.
But the "slots" in the error message refer to a higher-level abstraction: the programmable "key slots" on the card itself. You could view them with pkcs11-tool --list-slots or pkcs11-tool --list-token-slots.
You might also want to run opensc-tool --name to ...
Ok, partial answer:
A virtual machine only sees the hardware that is provided to it. This can be "real" hardware that is "stolen" from the physical machine the VM runs on, or it can be "simulated" hardware like the VMware USB hub and mouse.
Not knowing your situation, assuming that an USB smart card reader is connected to the physical machine, it won't ...
From https://piv.idmanagement.gov/engineering/ssh/#ssh-from-macos and works pretty much the same on linux:
Insert your PIV/CAC into your card reader.
To view the certificates on your Mac, enter:
Make note of the PIV AUTH pubkey ID number.
Using reader with a card: SCR35xx Smart Card Reader
Public RSA Key [...
From a GnuPG point of view, there is no difference between NFC and directly plugged smart cards. No matter whether you use a traditional smart card, a USB plug or NFC, in all cases the driver exposes the smart card through the PC/SC or CCID protocols.
What you need to make sure to use an NFC smart card with OpenPGP:
the NFC chip actually supports the ...
You were getting the first error ("File not found") because of incorrect ownership of ~/.pki/nssdb/pkcs11.txt. Since it couldn't be accessed, it appeared to modutil to not exist.
The second error ("Failure to load dynamic library") is because the library is already loaded. See the second entry in the module list: "CAC Module": "library name: /usr/lib/...
You need to add certificate via certutil to database located in your case at /etc/pam_pkcs11/nssdb as well as making hashes at /etc/pam_pkcs11/cacerts
certutil -A -n nick_of_my_CA -t "TC,C,T" -d /etc/pam_pkcs11/nssdb -i my_ca.crt