topic Re: macOS certificate login with smart card in SASE and Remote Access

macOS certificate login with smart card

mcaesar — Fri, 08 Jan 2021 12:48:33 GMT

In macOS 10.14 Mojave the certificates on smart cards are visible in the keychain and thereby available for certificate login in Endpoint Security VPN when choosing the certificate login option.

In macOS 10.15 Catalina and macOS 11 Big Sur the certificates on smart cards are no longer visible in the keychain and as such not available for the VPN certificate login option anymore (Endpoint Security E84.30 macOS Client).

Endpoint Security VPN should rather use the CryptoTokenKit on macOS to read certificates from smart cards. Will this be fixed?

Re: macOS certificate login with smart card

PhoneBoy — Sat, 09 Jan 2021 03:54:42 GMT

I’m seeing a similar issue with non-SmartCard certificates.
I recommend a TAC case.

Re: macOS certificate login with smart card

AndreiR — Sat, 09 Jan 2021 11:58:44 GMT

Hi @mcaesar,

By default macOS 10.15 Cataline and 11 BigSur use CryptoKit framework for accessing smart cards. Currently VPN client does not support CryptoKit yet. It will be added soon.

In macOS 10.15 Catalina you may enable legacy framework TokenD. You should contact your smart card vendor and check with them if they support TokenD and how to enable it for their product.

Re: macOS certificate login with smart card

mcaesar — Mon, 11 Jan 2021 10:13:02 GMT

In macOS 10.15 Catalina it is indeed possible to enable tokend as described in the SmartCardServices-legacy(7) manpage.

sudo defaults write /Library/Preferences/com.apple.security.smartcard Legacy -bool true

But I need a solution for macOS 11 Big Sur. What is the roadmap for "soon", may I ask when support for CryptoTokenKit will be added?

Re: macOS certificate login with smart card

Vadim0147 — Mon, 25 Jan 2021 15:56:17 GMT

Hi.
Could you tell when support for CryptoTokenKit will be added to VPN client?

Re: macOS certificate login with smart card

Vadim0147 — Mon, 25 Jan 2021 16:00:38 GMT

Could you inform us, when support for CryptoTokenKit will be added to VPN Client?

Re: macOS certificate login with smart card

ssehovic — Wed, 24 Feb 2021 10:02:13 GMT

Hi @AndreiR ,

any news regarding CryptoKit framework? Is there a beta version that we could test and give a feedback?

We really need it for Big Sur so that we can ditch virtual Windows 10 inside Parallels 😉

Best regards,

Re: macOS certificate login with smart card

mcaesar — Tue, 04 May 2021 16:30:11 GMT

Hi @AndreiR

I have installed E84.70 macOS client, but I still cannot authenticate using a smart card. When will CryptoTokenKit be supported?

Re: macOS certificate login with smart card

mcaesar — Fri, 21 Oct 2022 16:03:11 GMT

Hi @AndreiR

will smart card login with certificates be supported on macOS using CryptoTokenKit be supported?

I just tried latest version client VPN E86.70 but I still cannot select the certificates from the smart card.

Re: macOS certificate login with smart card

ssehovic — Fri, 21 Oct 2022 17:08:12 GMT

Hi @mcaesar,

you have to have SafeNet Authentication Client installed on your mac. SAC reads certificate from your smartcard. I can confirm that finally checkpoint vpn 86.60 works.

Hope this information will help you.