macOS certificate login with smart card

[mcaesar]

In macOS 10.14 Mojave the certificates on smart cards are visible in the keychain and thereby available for certificate login in Endpoint Security VPN when choosing the certificate login option. 

In macOS 10.15 Catalina and macOS 11 Big Sur the certificates on smart cards are no longer visible in the keychain and as such not available for the VPN certificate login option anymore (Endpoint Security E84.30 macOS Client).

Endpoint Security VPN should rather use the CryptoTokenKit on macOS to read certificates from smart cards. Will this be fixed?

[PhoneBoy]

I’m seeing a similar issue with non-SmartCard certificates.
I recommend a TAC case.

[AndreiR]

Hi @mcaesar,

By default macOS 10.15 Cataline and 11 BigSur use CryptoKit framework for accessing smart cards. Currently VPN client does not support CryptoKit yet. It will be added soon.

In macOS 10.15 Catalina you may enable legacy framework TokenD. You should contact your smart card vendor and check with them if they support TokenD and how to enable it for their product.  

[Vadim0147]

Hi.
Could you tell when support for CryptoTokenKit will be added to VPN client?

[Vadim0147]

Hi

Could you inform us, when support for CryptoTokenKit will be added to VPN Client?

[ssehovic]

Hi @AndreiR ,

any news regarding CryptoKit framework? Is there a beta version that we could test and give a feedback?

We really need it for Big Sur so that we can ditch virtual Windows 10 inside Parallels 😉

Best regards,

S.

[mcaesar]

Hi @AndreiR 

I have installed E84.70 macOS client, but I still cannot authenticate using a smart card. When will CryptoTokenKit be supported?

[mcaesar]

In macOS 10.15 Catalina it is indeed possible to enable tokend as described in the SmartCardServices-legacy(7) manpage.

sudo defaults write /Library/Preferences/com.apple.security.smartcard Legacy -bool true

But I need a solution for macOS 11 Big Sur. What is the roadmap for "soon", may I ask when support for CryptoTokenKit will be added?

[mcaesar]

Hi @AndreiR 

will smart card login with certificates be supported on macOS using CryptoTokenKit be supported?

I just tried latest version client VPN E86.70 but I still cannot select the certificates from the smart card.

[ssehovic · Accepted solution]

Hi @mcaesar,

you have to have SafeNet Authentication Client installed on your mac. SAC reads certificate from your smartcard. I can confirm that finally checkpoint vpn 86.60 works.

Hope this information will help you.

S.