Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>First, you need to install PKCS #11 support. This is some native code that probably came with your card reader that provides a .dll (or .so) that provides a PKCS #11 interface. Other software on the system, like Mozilla products and Sun's PKCS #11 provider, uses this library. (Microsoft products often use a different interface, "CAPI".)</p> <p>Then, following the directions in the <a href="http://java.sun.com/j2se/1.5.0/docs/guide/security/p11guide.html" rel="nofollow noreferrer">PKCS #11 Reference Guide,</a> set up a <code>SunPKCS11</code> provider. The only properties that I had to supply in my setup are the location of the native "library" that was installed, and the "name" suffix for this provider. The "name" property is appended to "SunPKCS11-", so if you specify "CAC" for the name, you can lookup the <code>Provider</code> later with <code>Security.getProvider("SunPKCS11-CAC")</code>.</p> <p>Then, you can use the standard JSSE system properties <code>javax.net.ssl.keyStore</code> (with a value of <code>"NONE"</code>) and <code>javax.net.ssl.keyStoreType</code> (with a value of <code>"PKCS11"</code>) to give the JSSE access to the key material on the CAC. You don't need to set the password property, because the native code should prompt the user for their PIN when needed.</p> <p>The caveat is that only the user's "end entity" certificate is available from the CAC. To build a trusted chain, most servers expect the client to send any intermediate certificates. Working around this is possible, but complicated, as it involves implementing your own <code>javax.net.ssl.X509KeyManager</code>. If the server you are working with requires a complete chain, please post a follow-up question.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload