Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN.
Is it anyhow possible to do the following?
- Run some console tool
- Tool ideally asks for PIN directly or at least triggers the standard dialog
- Auth information can be submitted to the secure location site
I have tried so far OpenSC but it says the card is not supported.
This question focuses on how to perform the auth part with the PKI card, not how to use the API of the secured site.
Some findings so far based on @phl's answer.
To check for functions offered by the card's driver, I did the following.
# explore Debian package of the driver installer dpkg -c <filename>.deb | grep .so # list functions offered by the library and search for the target function nm -D <library> | grep C_GetFunctionList
Here it was!
<hexvalue> T C_GetFunctionList
Then, I have tried to call this function from Python/ctypes.
from ctypes import * cardfun1 = cdll.LoadLibrary("xxxxyyy.so") print(cardfun1.C_GetFunctionList(None))
And the output is:
7. What then?!
Also, my impression is that is should be somehow possible to combine OpenSSL with the driver but in examples I can find so far people use the card to store the SSH key.
While OpenSSL is not possible with this card (no exported function bind_engine), with PyKCS11 it is anyway possible to use card's PIN and call its security functions. So the hint by @phl is the answer.
session = pkcs11.openSession(slot, CKF_SERIAL_SESSION | CKF_RW_SESSION) session.login(<PIN>)