[gentoo-hardened] smartcards: apache & openssl - internet explorer / mozilla

[Daniel Struck]

Hello,

I am a little bit puzzled how to solve what I try to do:

Idea: Clients should be authenticated to apache over openssl by a client-certificate.
I got it working on gentoo without a problem, well after applying a patch provided on bugs.gentoo.org (bug 25258) ;-)

Now I want to put the client-certificates on smartcards, problem:
I don't know yet how to do this :-(

My basic understanding is that, the key (private&public) is generated on the smartcard, then the public key? is send out to be signed by a CA.
I think on Windows this steps are performed by Internet Explorer by contacting a CA.

My question: Is it possible to prepare the smartcards for the clients on a gentoo station and how should one proceed to do it?
(I think opensc with muscle-driver could provide this fonctionality?)

Does anyone by chance know good documentations/ books on this subject?

Best regards,
Daniel Struck



--
gentoo-hardened@g.o mailing list