minvws / puzi-python Goto Github PK

When a Windows computer is used by multiple people, the operating system remembers previously used certificates. Browsers (Chrome, Edge and Firefox) ask the user to select a certificate to verify their identity.

Of course, only one certificate corresponds to the UZI card that is currently in the smart card reader, and users need to enter their PIN to prove it is theirs, but from a usability perspective this is rather inconvenient.

Are their ways to circumvent this dialog? On macOS the user is only asked to confirm the UZI card that is actually in the reader, which is much more user friendly.

This is not specific to the implementation in this repository, but applies to all websites accepting UZI cards via client certificate authentication.

With nginx/1.21.6 running with OpenSSL 1.1.1n (Linux) I am unable to get a working configuration that supports Safari (v15.4 on macOS v12.3.1).

A default Nginx configuration that requires TEST Zorg CSP Root CA G3 as client certificate with ssl_verify_client on and ssl_verify_depth 3 works properly with Chrome and Firefox, but Safari fails to establish a secure connection to the server.

Nginx reports the error: SSL_do_handshake() failed (SSL: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback) while SSL handshaking.

This can be reproduced in isolation from Nginx with openssl s_server:

openssl s_server -key key.pem -cert cert.pem \
                 -accept 3000 -www -Verify 3 \
                 -CAfile test_zorg_csp_root_ca_g3.pem \
                 -tls1_2 -debug

Firefox and Chrome will ask for the certificate and PIN and show a proper response when connecting to https://localhost:3000, but Safari shows an error after asking for the client certificate. The error log from openssl s_server shows:

140184936240448:error:14209102:SSLroutines:tls_early_post_process_client_hello:unsupported protocol:../ssl/statem/statem_srvr.c:1685:

Using openssl s_server with LibreSSL instead of OpenSSL works, but only for LibreSSL 2.8.3 and LibreSSL 2.9.0. LibreSSL is currently the default on macOS, so it was a bit of a coincidence to notice this working. This version of LibreSSL also works on Ubuntu but the latest release LibreSSL 3.5.1 shows the same problem as OpenSSL with Safari.

Although this is not directly related to this particular repository, it would be helpful to have an example of a working Nginx configuration that support all major browsers to get started with UZI card authentication.