OpenVPN does not show all certs from yubikey via pkcs11-providers opensc-pkcs11.dll
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
User get prompted to select the certificate for cert-based authentication. This menu does not show/offer all available certs on a yubikey 5 NFC.
Missing cert is in slot 82.
See output:
Yubikeys own tool reports:
C:\Windows\System32>ykman piv info
PIV version: 5.4.3
PIN tries remaining: 3/3
PUK tries remaining: 0/3
Management key algorithm: TDES
PUK is blocked
Management key is stored on the YubiKey, protected by PIN.
CHUID: ....
CCC: No data available
Slot 82 (RETIRED1):
Private key type: ECCP384
Public key type: ECCP384
Subject DN: CN=.....
Issuer DN: CN=.....
Serial: 00:28:00:00:.....
Fingerprint: 79d3fffc8a3b18a6c.....
Not before: 2024-09-09T06:34:26+00:00
Not after: 2025-03-08T06:34:26+00:00
Slot 9A (AUTHENTICATION):
Private key type: ECCP384
Public key type: ECCP384
Subject DN: CN=.....
Issuer DN: CN=.....
Serial: 00:28:00:00:00.....
Fingerprint: 2ebf9ab673ba14.....
Not before: 2024-01-26T17:11:24+00:00
Not after: 2024-07-24T17:11:24+00:00
Slot 9D (KEY_MANAGEMENT):
Private key type: ECCP384
Public key type: ECCP384
Subject DN: CN=.....
Issuer DN: CN=.....
Serial: 00:28:00:00:.....
Fingerprint: bfb1ab325e4......
Not before: 2024-06-28T14:31:13+00:00
OpenSC debugging:
C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -I
Cryptoki version 3.0
Manufacturer OpenSC Project
Library OpenSC smartcard framework (ver 0.26)
Using slot 0 with a present token (0x0)
Option -T
C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -T
Available slots:
Slot 0 (0x4): Yubico YubiKey FIDO+CCID 0
token label : John Doe
token manufacturer : piv_II
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN initialized
hardware version : 0.0
firmware version : 0.0
serial num : 6aed8be786e35738
pin min/max : 4/8
uri : pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=6aed8be786e35738;token=John%20Doe
Option -L
C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -L
Available slots:
Slot 0 (0x0): Microsoft UICC ISO Reader 5ef02fb8 0
(token not recognized)
Slot 1 (0x4): Yubico YubiKey FIDO+CCID 0
token label : John Doe
token manufacturer : piv_II
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN initialized
hardware version : 0.0
firmware version : 0.0
serial num : 6aed8be786e35738
pin min/max : 4/8
uri : pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=6aed8be786e35738;token=John%20Doe
To Reproduce
Use Openvpn client with pkcs11-providers and point to opensc-pkcs11.dll. Have certificate on yubikey in slot 82.
Expected behavior
OpenVPN menu should show all available certs on yubikey.
Version information (please complete the following information):
Windows 11, latest openvpn 64 bit.
Additional context
Looks like, it shows only certs in the common slots 9a,9b,9c,9d, not the additional slots 82....95.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the OpenVPN client using pkcs11-providers and opensc-pkcs11.dll, with a certificate in YubiKey slot 82. Trace certificate enumeration from the PKCS#11 provider and compare the returned slots with the OpenSC output; done means the certificate selection menu includes certificates from additional slots such as 82.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100