Build of OpenConnect 7.05+ for EL6?

Oliver Hernandez mr.oliver.hernandez at
Mon Jul 11 12:05:39 PDT 2016

(it may be a while before I get to testing that new version of libp11)

I finally got an OpenConnect RPM built that will install on my EL6
system.  But, no matter what pkcs11 URL I tried, it fails to load the
certificate after I enter my PIN.

To rule out any nuances with EL6, I installed OpenConnect on a CentOS
7 VM, and I'm getting the same error!

I'm following the how-to from here:

# p11tool --list-all-certs

gives me in the output the certificate I need to use to authenticate
with, the second one listed:

Object 1:
 URL: pkcs11:model=;manufacturer=;serial=;;id=%00%02;object=CAC%20Email%20Signature%20Certificate;object-type=cert
 Type: X.509 Certificate
 Label: CAC Email Signature Certificate
 ID: 00:02

And the result of attempting to connect:

# openconnect --no-cert-check -c
Attempting to connect to server
PIN required for
Enter PIN:
Error loading certificate from PKCS#11: The requested data were not available.
Loading certificate failed. Aborting.
Failed to open HTTPS connection to
Failed to obtain WebVPN cookie


On Mon, Jul 11, 2016 at 3:31 AM, Nikos Mavrogiannopoulos
<n.mavrogiannopoulos at> wrote:
> I've pushed the latest version of libp11 for el6. To speed this
> inclusion, please leave some karma at:
> On Fri, Jul 8, 2016 at 1:40 PM, David Woodhouse <dwmw2 at> wrote:
>> On Fri, 2016-07-08 at 10:24 +0100, David Woodhouse wrote:
>>> On Fri, 2016-07-08 at 10:53 +0200, Nikos Mavrogiannopoulos wrote:
>>> > On Thu, Jul 7, 2016 at 11:20 PM, Oliver Hernandez
>>> > <mr.oliver.hernandez at> wrote:
>>> > > I now have a need to connect to a Cisco VPN that authenticates with a
>>> > > PKCS Smart Card.  This EL6 build of OpenConnect does not have the
>>> > > PKCS#11 support.  Any chance there's an EL6 version of OpenConnect 7
>>> > > built with PKCS#11 support?  Thanks!
>>> >
>>> > No the libraries there are too old. You'll have to use RHEL7.
>>> Don't we just need to package libp11 for EPEL6?
>> I made a scratch build of libp11 for EL6:
>> I installed this (and p11-kit-devel) on a CentOS 6 VM and built
>> OpenConnect. It seems to work.
>> --
>> dwmw2

More information about the openconnect-devel mailing list