On Wed, 2019-04-17 at 10:14 -0400, Smithy Smith wrote: > Hello Openconnect Team, > > I have been trying to build and run your software but I am running > into some issues. Please forgive me if this information already > exists somewhere else. I am trying to get my smartcard to function > with openconnect on Mac and Linux, but I have not had much luck. > > 1. On MacOS 10.14, does openconnect support Apple's CryptoTokenKit? > I know there is PKCS#11 support, but if I have a build of openconnect > with PKCS#11 support, will it work with CryptoTokenKit? If not, is > OpenSC the best option? Neither OpenConnect nor GnuTLS have native CryptoTokenKit support. However, I) believe https://github.com/kenh/keychain-pkcs11 is intended to bridge that gap and provide a standard PKCS#11 interface. Alternatively, yes. Depending on your actual smartcard, using the OpenSC PKCS#11 provider should work too. > 2. I am trying to build openconnect via Homebrew on my Mac with > openssl. While I have been successful building using the option > “--without-gnutls”, I cannot get PKCS#11 support in the same build. > When I drop that option, the PKCS#11 support comes back. Is PKCS#11 > supported with openssl on Mac? That seems to imply that your GnuTLS is built without PKCS#11 support. You'll need to rebuild that with PKCS#11 support and then it should work. > 3. In Ubuntu 18.04, I am running openconnect v7.08-3 (installed via > apt-get), but I get an error "SSL connection failure: Key usage > violation in certificate has been detected." The gnutls faq > (https://gnutls.org/faq.html) says that "newer versions of GnuTLS will > also allow such key usage violations (and will only output a warning > message)". Is there an option or some other way to tell openconnect > to ignore this error? This happens even before you try to use your smartcard to authenticate? It's actually complaining about the *server* cert?
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ openconnect-devel mailing list openconnect-devel@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/openconnect-devel
