https://github.com/philipWendland/IsoApplet/wiki/Initialization
Serial: DEADBEEFCAFEBABEC0DEFEE1 PIN: 123456789 PUK: deadbeefcafebabe
Once applet is loaded, it's necessary to add the javacard's ATR to opensc.conf so that the middleware knows what driver to use:
card_atr 3b:fc:18:00:00:81:31:80:45:90:67:46:4a:01:00:11:06:00:00:00:00:7c {
driver = "isoApplet";
}
Then proceed to initiate the card with the instructions (here)[https://github.com/philipWendland/IsoApplet/wiki/Initialization].
Short:
pkcs15-init --create-pkcs15
pkcs15-init --generate-key "rsa/2048" --auth-id "FF" --label "myKey" --id "1"
The OpenSSL command to load the PKCS#11 module is much more straight-forward by putting the apropriate section at the top of /etc/ssl/openssl.cnf:
[openssl_init]
engines=engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
#dynamic_path = /usr/lib/ssl/engines/libpkcs11.so
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/libpkcs11.so
MODULE_PATH = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
init = 0
See:
Exporting the public key for key slot 2 from a card: pkcs15-tool --read-ssh-key 2
See:
Test that your PKCS11 module and the card is working:
pkcs11-tool --test --login
Remember, if your card reader is a keyboard or has a PIN pad, it might look like the command is hanging, but the keyboard is probably just waiting for your PIN!
Find the URI for your card:
p11tool --list-token-urls
For an ISOApplet card, you should see something like pkcs11:model=PKCS%2315;manufacturer=unknown;serial=0000;token=JavaCard%20isoApplet%20%28User%20PIN%29. We'll call this $TOKEN_URL from here out.
Key references in the pkcs11 module are also refered to by URLs. To obtain the URLs for the keys presently on the card, use:
p11tool --list-privkeys --login $TOKEN_URL
Object 0:
URL: pkcs11:model=PKCS%2315;manufacturer=unknown;serial=0000;token=JavaCard%20isoApplet%20%28User%20PIN%29;id=%01;object=myKey;type=private
Type: Private key
Label: myKey
Flags: CKA_PRIVATE; CKA_NEVER_EXTRACTABLE; CKA_SENSITIVE;
ID: 01
To generate an x509 key against one of those URLs, use OpenSSL:
openssl req -new -x509 -days 365 -subj '/CN=my key/' -sha256 -engine \
pkcs11 -keyform engine -key "$PKCS11_URL" -out cert.pem
substituting for the apropriate private key on the card. To self-sign
the CSR req.csr:
openssl x509 -req -CAkeyform engine -engine pkcs11 \
-in req.csr -CA cert.pem -CAkey "$PKCS11_URL" -set_serial 1 -sha256
And you should get your certificate.
Alternatively, generate a CSR for externally signing with a CA:
openssl req -new -days 365 -subj '/CN=rechner' -sha256 \
-engine pkcs11 -keyform engine -key "$PKCS11_URL" -out ipacert.csr
NOTE that there is a bug in OpenSSL present in versions 1.0.1 through 1.1.0f (fixed in 1.1.0g), if you get a message like "bad format 'engine'; must be pem or der", see this github issue. There doesn't seem to be any way around this except installing a version with the fix.
Load the certificate back onto the card:
pkcs15-init --store-certificate signed.crt --id 1 --cert-label "user@realm"
Take a look at this article. There's a few ways we could go about this, but an IPA-joined machine should have most of the aformentioned setup with nsss completed already.