I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't found a proxy, which is able to do this.

  1. Burp Suite: Burp supports smartcards and I can successfully load the keys from the smartcard (the needed dll is called cardos11_64.dll). However during the SSL handshake it will eventually throw an exception with: SSLException: Error signing certificate verify

I am in the process of testing it with different Java versions, but no luck so far.

  1. ZAP proxy Burp support suggested to tunnel through a ZAP proxy. The smartcard driver what I need is not built in but I can again choose the same dll. However then the GUI becomes somewhat funny and I cannot change to the Keystore tab anymore so I cannot really select the keys. When I hover the mouse over the right place then a button appears, which might actually load a key (still not sure whether it is the right one). But then when I try to connect, it will throw an exception with problems in writing a socket.

So the question is, does anyone know a way to proxy SSL traffic where the smartcard is not only used in authentication, but in the whole SSL handshake?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.