I am having a GPF-Cryptostick running on ubuntu 11.04 with firefox 5.0. Using a smartcard is such a great thing, but i did not found any good how-tos. Maybe it is just a lack of understanding.
First: My Cryptostick (Smartcard) works fine. I am using it to ssh to remote server. i can see my smartcard with
gpg --card-status and
ssh-add -l shows my key. Everything works fine.
Second: I have set up a website which requires apache2/mod-ssl ClientAuthentication with
SSLVerifyClient require SSLCACertificateFile conf/whatever/ca.crt SSLVerifyDepth 1
I made this by generating my own CA with openssl, and creating a certificate signed by my own CA and importing this into firefox. works, too.
Problem: Now i want to authenticate at this website with my smartcard. Most of the time i read something about loading a pkcs#11 lib into firefox. I tried
- /usr/lib/pkcs11/libcoolkeypk11.so from coolkey package
- promoted by manufactor of my smartcard: http://smartcard-auth.de/download-de.html
Both can't be loaded by Firefox. Firefox just says "module could not be loaded" without any further information (orginial error message is in german in my case). I am rather clueless about the internals of certificates and pcks#11, firefox and so on.
So i have a few questions:
- Is it possible at all to authenticate with my USB smartcard at a website?
- If yes, what lib do I need to let Firefox/5.0 use my smartcard? Does it depend on my card, so every card needs a special pkcs#11 driver?
If i manage it to let firefox use my smartcard i guess i have to handle to upload a subkey to my smartcard to use my self generated CA of my webserver. But this is another story.
if you need further information to help me, please let me know. i did not put every bit in here to keep my question short.