I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't found a proxy, which is able to do this.
- Burp Suite: Burp supports smartcards and I can successfully load the keys from the smartcard (the needed dll is called cardos11_64.dll). However during the SSL handshake it will eventually throw an exception with: SSLException: Error signing certificate verify
I am in the process of testing it with different Java versions, but no luck so far.
- ZAP proxy Burp support suggested to tunnel through a ZAP proxy. The smartcard driver what I need is not built in but I can again choose the same dll. However then the GUI becomes somewhat funny and I cannot change to the Keystore tab anymore so I cannot really select the keys. When I hover the mouse over the right place then a button appears, which might actually load a key (still not sure whether it is the right one). But then when I try to connect, it will throw an exception with problems in writing a socket.
So the question is, does anyone know a way to proxy SSL traffic where the smartcard is not only used in authentication, but in the whole SSL handshake?