You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
YubiKey (PIV) Client Certificate Not Usable
I am trying to use a YubiKey (5 NFC, PIV mode) as a client certificate for WebDAV(HTTPS) access. The behavior is as follows:
On Windows
• The certificate on the YubiKey is visible in the system certificate store
• Mountain Duck can successfully select and use it for client authentication
On macOS
• The YubiKey works correctly at the system level (e.g., login and browser authentication both prompt for PIN and succeed)
• However, the certificate does not appear in Mountain Duck’s client certificate list
• It is also not visible in Keychain Access
Additional Testing
• Using OpenSC (pkcs11-tool), I can see both the certificate and private key after login
• I have configured:
pkcs11.provider=/Library/OpenSC/lib/opensc-pkcs11.so
• However, Mountain Duck / Cyberduck does not trigger a PIN prompt and does not appear to load the PKCS#11 provider
Based on this, I suspect this may be related to the difference between macOS SmartCard (CryptoTokenKit) and PKCS#11 handling, and that Mountain Duck may only read certificates from the Keychain.
I would like to ask:
Does Mountain Duck on macOS support using client certificates from hardware tokens (such as YubiKey) via PKCS#11?
Is there any way to make SmartCard (CryptoTokenKit) certificates visible or usable in Mountain Duck?
Are there any recommended configurations for macOS + YubiKey PIV + WebDAV(HTTPS) scenarios?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
YubiKey (PIV) Client Certificate Not Usable
I am trying to use a YubiKey (5 NFC, PIV mode) as a client certificate for WebDAV(HTTPS) access. The behavior is as follows:
On Windows
• The certificate on the YubiKey is visible in the system certificate store
• Mountain Duck can successfully select and use it for client authentication
On macOS
• The YubiKey works correctly at the system level (e.g., login and browser authentication both prompt for PIN and succeed)
• However, the certificate does not appear in Mountain Duck’s client certificate list
• It is also not visible in Keychain Access
Additional Testing
• Using OpenSC (pkcs11-tool), I can see both the certificate and private key after login
• I have configured:
pkcs11.provider=/Library/OpenSC/lib/opensc-pkcs11.so
• However, Mountain Duck / Cyberduck does not trigger a PIN prompt and does not appear to load the PKCS#11 provider
Based on this, I suspect this may be related to the difference between macOS SmartCard (CryptoTokenKit) and PKCS#11 handling, and that Mountain Duck may only read certificates from the Keychain.
I would like to ask:
Beta Was this translation helpful? Give feedback.
All reactions