This setup used to work just fine. When I would insert my CAC, my certificates would immediately propagate to the certificate store (as evidenced by Certificate Manager,
certmgr.msc), and I could log on to websites that required a CAC for access.
Recently, I stopped being able to access the websites. Looking in Certificate Manager, I see that only one, or sometimes two of my certificates are present. If I delete them, and re-insert my card a different certificate may appear.
I just returned and replaced the reader with the same model, so I know it is not the culprit.
I finally thought to look at the system log, and noticed the following errors upon smart card insertion:
The errors, in chronological order:
Smart Card Service Event ID: 610 Smart Card Reader 'SCM Microsystems SCR33xx v2.0 USB SC Reader 0' rejected IOCTL TRANSMIT: Incorrect function. If this error persists, your smart card or reader may not be functioning correctly. Command Header: 00 c0 00 00 WudfUsbccidDrv Event ID: 11 A Request has returned failure. MsgType: 0x80 ICCStatus: 0x0 CmdStatus: 0x1 Error: 0xf6 // ICC_PROTOCOL_NOT_SUPPORTED SW1: 0x0 SW2: 0x0 WudfUsbccidDrv Event ID: 11 An operation has failed (0x0, 0x0, 0x0, 0x0). ScT0Transmit: Failed to send request at TPDU level. HResult: The specified request is not a valid operation for the target device. // Note: this one comes from WUDFUsbccidDriver.dll CMyDevice::UsbScT0Transmit+7D0h WudfUsbccidDrv Event ID: 10 Request(CLS=0x0,INS=0xc0,P1=0x0,P2=0x0,Lc=0,Le=256,.NETServiceMethod=0x0)
It appears that the hardware indicated failure during the
IOCTL TRANSMIT, which trickled down through the user-mode driver framework.
Edit: Consulting the CCID spec, it appears that the card is responding back with
bmCommandStatus = 1 - Failed (error code provided by the error register). And
Error = ICC_PROTOCOL_NOT_SUPPORTED -10 (F6h). I'm assuming the driver translates this error into the "HResult: The specified request is not a valid operation for the target device." message.
Also, the command being sent was INS=0xC0, which is GET RESPONSE.
How can it say protocol not supported? What is the driver doing differently than when it worked? Note that I also just tried this with a new CAC, and I'm seeing similar behavior. A problem with the card reader, or driver?
Considering I just replaced the reader (and re-installed drivers, rebooted, etc.) is there something wrong with my Smart Card? I'm assuming not, because it does work with another reader on another system. I haven't tried a different reader on the same system.
In fact, the same reader connected to a Windows 7 VM on the same physical machine works just fine! Something is clearly broken, and it's driving me nuts trying to figure out what.
So what is the problem?