Implementing OpenSSH Certificates with smartcards

Question

I want to implement public key authentication with CA and smart card. OpenSSH have their own certificate format, which is not x509.

I have a server (SSHD) and a client. I already made public key authentication happen with CA, now I want to insert into the equation a smart card. I use ARX cryptokit to access the smart card and I want to import my key and certificate into the smart card. When I click "Import key", it says that I need PKCS12 format certificate to import. I tried to convert my OpenSSH certificate and RSA private key to pkcs12 using Openssl, but it isn't accepting my certificate. I saw that it requires PEM encoding but I can't seem to make it happen.

So my questions:

1. How do I convert OpenSSH certificate and key to PKCS12?
2. Can I actually use smartcards with OpenSSH server and CA and the whole package?

Thanks in advance.

EDIT: I will tell you the commands i wrote so there wont be any misunderstandings

Generating CA keys Ssh-keygen -t RSA -f CA

Generating user keys Ssh-keygen -t Rsa -f User

Signing User key Ssh-keygen -s CA.priv -I identity -n username -V +52W User.pub

Now the output is user-cert.pub I want to turn my certificate and private key to pkcs12 format

Openssl pkcs12 -export -out certificate.pfx -inkey user.priv -in user-cert.pub -certfile CA-cert.pub

CA-cert.pub is self signed certificate i generated the same with generating the user key.

The output of the last command is "unable to load certificates" I tried it without the last part of "-certfile Ca-cert.pub" and the output is still the same.

hope someone has an idea.

Answer 1

1. OpenSSL can do the coversion.

   openssl pkcs12 -export -out servercert.p12 -inkey servercert.key -in servercert.crt -certfile CACert.crt

2. Yes, you can, but you'll need some tools:

   • one to interface to the SmartCard on the low level: the CryptoAPI / OpenCT (Win/Ux)
   • one to handle the content on the SmartCard (like OpenSC)
   • one that performs the authentication
   • one for playing with certificates and such (OpenSSL, like in example above)
   • scripts to make everything smooth (ps / perl)