OpenVPN / OpenVPN/openvpn

OpenVPN does not show all certs from yubikey via pkcs11-providers opensc-pkcs11.dll

Open
#656 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

User get prompted to select the certificate for cert-based authentication. This menu does not show/offer all available certs on a yubikey 5 NFC.

Missing cert is in slot 82.

grafik

See output:

Yubikeys own tool reports:

C:\Windows\System32>ykman piv info
PIV version:              5.4.3
PIN tries remaining:      3/3
PUK tries remaining:      0/3
Management key algorithm: TDES
PUK is blocked
Management key is stored on the YubiKey, protected by PIN.
CHUID: ....
CCC:   No data available
Slot 82 (RETIRED1):
  Private key type: ECCP384
  Public key type:  ECCP384
  Subject DN:       CN=.....
  Issuer DN:        CN=.....
  Serial:           00:28:00:00:.....
  Fingerprint:      79d3fffc8a3b18a6c.....
  Not before:       2024-09-09T06:34:26+00:00
  Not after:        2025-03-08T06:34:26+00:00

Slot 9A (AUTHENTICATION):
  Private key type: ECCP384
  Public key type:  ECCP384
  Subject DN:       CN=.....
  Issuer DN:        CN=.....
  Serial:           00:28:00:00:00.....
  Fingerprint:      2ebf9ab673ba14.....
  Not before:       2024-01-26T17:11:24+00:00
  Not after:        2024-07-24T17:11:24+00:00

Slot 9D (KEY_MANAGEMENT):
  Private key type: ECCP384
  Public key type:  ECCP384
  Subject DN:       CN=.....
  Issuer DN:        CN=.....
  Serial:           00:28:00:00:.....
  Fingerprint:      bfb1ab325e4......
  Not before:       2024-06-28T14:31:13+00:00

OpenSC debugging:

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -I
Cryptoki version 3.0
Manufacturer     OpenSC Project
Library          OpenSC smartcard framework (ver 0.26)
Using slot 0 with a present token (0x0)

Option -T

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -T
Available slots:
Slot 0 (0x4): Yubico YubiKey FIDO+CCID 0
  token label        : John Doe
  token manufacturer : piv_II
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 6aed8be786e35738
  pin min/max        : 4/8
  uri                : pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=6aed8be786e35738;token=John%20Doe

Option -L

C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool -L
Available slots:
Slot 0 (0x0): Microsoft UICC ISO Reader 5ef02fb8 0
  (token not recognized)
Slot 1 (0x4): Yubico YubiKey FIDO+CCID 0
  token label        : John Doe
  token manufacturer : piv_II
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 6aed8be786e35738
  pin min/max        : 4/8
  uri                : pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=6aed8be786e35738;token=John%20Doe

To Reproduce
Use Openvpn client with pkcs11-providers and point to opensc-pkcs11.dll. Have certificate on yubikey in slot 82.

Expected behavior
OpenVPN menu should show all available certs on yubikey.

Version information (please complete the following information):
Windows 11, latest openvpn 64 bit.

Additional context

Looks like, it shows only certs in the common slots 9a,9b,9c,9d, not the additional slots 82....95.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the OpenVPN client using pkcs11-providers and opensc-pkcs11.dll, with a certificate in YubiKey slot 82. Trace certificate enumeration from the PKCS#11 provider and compare the returned slots with the OpenSC output; done means the certificate selection menu includes certificates from additional slots such as 82.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.