|
Hi,
On 14/12/20 08:08, George wrote:
Hi,
I'm new to OpenSSL and am trying to set up mutual
authentication in a client. The client is setup with OpenSSL
1.0.2u. and the client's certificate + private key is stored on a
Smart Card. When the client receives a certificate request from
the server during the mutual authentication handshake, the OpenSSL
client_cert_cb callback function is automatically invoked.
The problem is that client_cert_cb requires a private key.
Unfortunately, it is not possible to get a private key from a
Smart Card. Is there a way to send a certificate to the server
without needing the private key?
I'm setting up the callback function with:
void
SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int
(*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
Here is a sample of what my code looks like when I set this up:
SSL_CTX_set_client_cert_cb(context,
openSSLClientAuthenticationCallBack);
int openSSLClientAuthenticationCallBack(SSL *ssl, X509
**x509, EVP_PKEY **pkey)
{
. . .
}
I can access the Smart Card using the PKCS#11 interface and I'm
able to get the certificate and sign it, etc. However, I cannot
get the actual private key from the Smart Card.
Does anyone know how I can get around this problem?
to use a pkcs#11 smartcard you normally use the OpenSSL pkcs11
engine ; you then do something like:
engine_name = "pkcs11";
ENGINE_register_all_complete();
pkey_engine = ENGINE_by_id( "dynamic" );
if (pkey_engine)
{
if (!ENGINE_ctrl_cmd_string(pkey_engine, "SO_PATH",
engine_name, 0)
|| !ENGINE_ctrl_cmd_string(pkey_engine, "LOAD", NULL,
0))
{
warn( "EAP-TLS: Error loading dynamic engine '%s'",
engine_name );
log_ssl_errors();
ENGINE_free(e);
pkey_engine = NULL;
}
}
}
if (pkey_engine)
{
if(!ENGINE_set_default(pkey_engine, ENGINE_METHOD_ALL))
}
pkey_engine = eaptls_ssl_load_engine( "pkcs11" );
pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier,
transfer_pin, &cb_data);
SSL_CTX_use_PrivateKey(ctx, pkey);
where "transfer_pin" is a callback UI function to query the user for
the pkcs11 device password.
More detailed code can be found in my pppd EAP-TLS patch, file
eap-tls.c at
https://github.com/jjkeijser/ppp/blob/eap-tls/pppd/eap-tls.c
(and search for pkey_engine)
HTH,
JJK
|
