I've got a user who's
having some odd issues, and I'm told other users in our
organization see similar issues, oddly, intermittently,
inexplicably, etc. My user has a MacBook Pro running 10.7.5 with an SCR331 reader and she had PKard 1.2 That was working
for her, and then it wasn't. She complained that she could no
longer access CAC-enabled sites. There was an error about her
certs being rejected as being signed by "Unknown" (I don't
have the verbatim error here, she isn't available right now).
My first thought was, she
needs the DoD root and intermediate certs added to her
keychain. I'm used to HAVING to add them to Windows and Linux
machines, but every time this comes up, the response is kind
of a vague, "Oh, Macs don't need that, it'll 'just work'
without them", and I just don't understand how that could be.
But, she was able to use her CAC previously without the DoD certs.
Anyway, I did get them
added, but that didn't help. I was able to log on to my
profile and use my CAC just fine. I had someone else help me
(I'm new to OS X), and he wound up uninstalling PKard and
installing OpenSC 0.12, and his CAC started working in her
profile. But she couldn't use hers, so I created her a new
profile, and she could use her CAC again, for a few days. Now
she can't any more. I was discussing this with someone else,
who says, "Oh, this is a known issue, it happens all the time,
we haven't been able to find a particular solution that works,
etc."
I was just poking around
in my keychain a little to see what I could see. One thing I
notice is, DOD CA-30, for example (which is the CA that signed
the certs on my CAC) has a red warning, "This certificate has
an invalid issuer". The issuer is "DoD Root CA 2", and that certificate shows up with a green "This certificate is valid".
So I'm a little puzzled there. My CAC works just fine on
this machine (also 10.7.5, and I'm using PKard 1.2)
I'm sure my overarching
question probably has several possibly mostly-unrelated parts
to it. I'm not a huge PKI expert, and I'm no Mac expert.
It seems very possible that there are facets of PKI in
general, or as implemented by DoD, that I'm lacking, as well
as details about how Apple implements PKI. So, my ears are
open to any suggestions, possibilities, etc.
--
John
Oliver | SAIC
Defense
& Maritime Solutions
Surveillance
and Reconnaissance Solutions Division
SPAWAR
Systems Center - Pacific | Code 53223
Sr.
Systems Administrator
Bldg
600 | Room 428N
Office:
(619) 553-9567
Mobile:
(571) 481-0198
email@hidden
email@hidden
DCO:
email@hidden