Get Certificate URI By Using Token URI

user_9913765 0
Viewed 109

I am trying to use a USB Token on Ubuntu to access a VPN. This access has to be done by using openconnect, with the certificate's URI being used in the connection string.

Here's the issue, though: I can't figure out how to get my certificate's URI.

I have been able to make Ubuntu recognize the token, and by running the command below I can get its URI.

$ modutil -dbdir sql:.pki/nssdb/ -list

What I am missing is the next step: how can I get the URI of the certificate that's inside the token?

I know p11tool has a command --list-all-certs that lets users do just that, but for some reason I have yet to figure out, p11tool is not recognizing this token, so I am looking for an alternative.

EDIT: Token is now being recognized by p11tool. But when using the token's URI to get the certificate's URI, message "No matching objects found" is being presented.

Here's the current output of p11tool --list-tokens. URL and serial have been purposely removed.

Token 1:
    URL: ##############
    Label: Soluti
    Type: Hardware token
    Flags: RNG, Requires login
    Manufacturer: SafeNet, Inc.
    Model: eToken
    Serial: ##############
    Module:
pkcs#11 certificate
1 Answers

To make p11tool recognize your token you must configure it by adding a line with a token to file /etc/gnutls/pkcs11.conf.

In my case the line looks like this:

load=/usr/lib/libeTPkcs11.so

EDIT1: The final command line will look like this:

p11tool --list-all-certs 'pkcs11:model=eToken'

EDIT2: Also you can issue command to list everything:

$ p11tool --login --list-all 'pkcs11:model=eToken'

Token 'Alex**************' with URL 'pkcs11:model=eToken;manufacturer=SafeNet%2C%20Inc.;serial=********;token=Alex****************' requires user PIN
Enter PIN: 
Object 0:
    URL: pkcs11:model=eToken;manufacturer=SafeNet%2C%20Inc.;serial=********;token=Alex****************;id=************************;type=private
    Type: Private key (RSA-2048)
    Label: 
    Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_NEVER_EXTRACTABLE; CKA_SENSITIVE; 
    ID: ***********************

Object 1:
    URL: pkcs11:model=eToken;manufacturer=SafeNet%2C%20Inc.;serial=********;token=Alex****************;id=************************;      object=te-SpecialSmartcardUserwithEncryp-04410;type=cert
    Type: X.509 Certificate (RSA-2048)
    Expires: ************************
    Label: te-SpecialSmartcardUserwithEncryp-04410
    ID: ***********************
user_38684640
Related