0

I want to implement public key authentication with CA and smart card. OpenSSH have their own certificate format, which is not x509.

I have a server (SSHD) and a client. I already made public key authentication happen with CA, now I want to insert into the equation a smart card. I use ARX cryptokit to access the smart card and I want to import my key and certificate into the smart card. When I click "Import key", it says that I need PKCS12 format certificate to import. I tried to convert my OpenSSH certificate and RSA private key to pkcs12 using Openssl, but it isn't accepting my certificate. I saw that it requires PEM encoding but I can't seem to make it happen.

So my questions:

  1. How do I convert OpenSSH certificate and key to PKCS12?
  2. Can I actually use smartcards with OpenSSH server and CA and the whole package?

Thanks in advance.

EDIT: I will tell you the commands i wrote so there wont be any misunderstandings

Generating CA keys Ssh-keygen -t RSA -f CA

Generating user keys Ssh-keygen -t Rsa -f User

Signing User key Ssh-keygen -s CA.priv -I identity -n username -V +52W User.pub

Now the output is user-cert.pub I want to turn my certificate and private key to pkcs12 format

Openssl pkcs12 -export -out certificate.pfx -inkey user.priv -in user-cert.pub -certfile CA-cert.pub

CA-cert.pub is self signed certificate i generated the same with generating the user key.

The output of the last command is "unable to load certificates" I tried it without the last part of "-certfile Ca-cert.pub" and the output is still the same.

hope someone has an idea.

Improve this question

1 Answer 1

Reset to default
0

  1. OpenSSL can do the coversion.

    openssl pkcs12 -export -out servercert.p12 -inkey servercert.key -in servercert.crt -certfile CACert.crt

  2. Yes, you can, but you'll need some tools:

    • one to interface to the SmartCard on the low level: the CryptoAPI / OpenCT (Win/Ux)
    • one to handle the content on the SmartCard (like OpenSC)
    • one that performs the authentication
    • one for playing with certificates and such (OpenSSL, like in example above)
    • scripts to make everything smooth (ps / perl)
Improve this answer
3
  • Hi, thanks for your answer. About the openssl command you wrote, i saw it in many sites but it did not work for me with the certificate i generated with ssh-keygen, it said couldnt load the certificates, that's why i though that it cant handle openSSH certificates.
    – Ilay Goldman
    Jan 28, 2019 at 21:52
  • That can happen if you have a chain of certificates and not just the one server certificate. In that case, you should include all intermediate certificates needed by the client to verify the chain.
    – Overmind
    Jan 29, 2019 at 8:35
  • Please look at the edit above, i put my certificate as well as the CA selfsigned certificate with the command i put there, still the same error. I even tried to turn my CA certificate which is self signed and its private key to pkcs12 so no other certificates are needed and still the same error
    – Ilay Goldman
    Jan 29, 2019 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy