openconnect with Belgian EID

[Christof Haerens]

Hi,

thxs for your reply.
I must say I'm not really a cert expert.

So what I'm guess what you are saying is that I should link also the ca of my EID to openconnect?

When I list the certs on my EID i get this list


% p11tool --list-certs --login
Token 'BELPIC (Basic PIN)' with URL 'pkcs11:model=PKCS%2315;manufacturer=%28unknown%29;serial=930D224B9E012C44;token=BELPIC%20%28Basic%20PIN%29' requires user PIN
Enter PIN:
Object 0:
     URL: pkcs11:library-description=Smart%20card%20PKCS%2311%20API;library-manufacturer=OpenSC%20%28www.opensc-project.org%29;model=PKCS%2315;manufacturer=%28unknown%29;serial=****;token=BELPIC%20%28Basic%20PIN%29;id=%02;object=Authentication;object-type=cert
     Type: X.509 Certificate
     Label: Authentication
     ID: 02

Object 1:
     URL: pkcs11:library-description=Smart%20card%20PKCS%2311%20API;library-manufacturer=OpenSC%20%28www.opensc-project.org%29;model=PKCS%2315;manufacturer=%28unknown%29;serial=****;token=BELPIC%20%28Basic%20PIN%29;id=%03;object=Signature;object-type=cert
     Type: X.509 Certificate
     Label: Signature
     ID: 03

Object 2:
     URL: pkcs11:library-description=Smart%20card%20PKCS%2311%20API;library-manufacturer=OpenSC%20%28www.opensc-project.org%29;model=PKCS%2315;manufacturer=%28unknown%29;serial=****;token=BELPIC%20%28Basic%20PIN%29;id=%04;object=CA;object-type=cert
     Type: X.509 Certificate
     Label: CA
     ID: 04

Object 3:
     URL: pkcs11:library-description=Smart%20card%20PKCS%2311%20API;library-manufacturer=OpenSC%20%28www.opensc-project.org%29;model=PKCS%2315;manufacturer=%28unknown%29;serial=****;token=BELPIC%20%28Basic%20PIN%29;id=%06;object=Root;object-type=cert
     Type: X.509 Certificate
     Label: Root
     ID: 06

So the ID 02 is Authentication, which is the one I use in openconnect -c pkcs11:
The ID 04(label CA) I should export and then pass to openconnect with the --cafile option?

Cheers
Christof


On 11/05/2013 01:36 PM, David Woodhouse wrote:
> On Tue, 2013-11-05 at 11:20 +0100, Christof Haerens wrote:
>> I try to connect to cisco with openconnect and my Belgian EID card. My
>> access is ok and no user/pw is needed. This is verified with my card
>> and using the anyconnect on windows.
> Hm, that really looks like it *ought* to be working. The only thing I
> can think of is that your server might need the full certificate trust
> chain, instead of just the 'leaf' cert itself. Can you ensure that your
> certificate authorities are installed correctly (or just use the
> --cafile option), and that you have a full trust chain for your personal
> cert? That way, openconnect will *offer* that chain on the wire, which
> might help with authentication.
>