pCardData->hScard is NULL!

[ROZOH]

Hi.
I have a fail login in IE SSL in windows 7 x64 and windows 8.1 x64. IE detects certificate but does not match with smart card attached.
I'm checking minidriver log file. There is two case that is vague for me.

• Both windows have pCardData->hScard = 0x00000000 but CardAcquireContext does not return SCARD_E_INVALID_HANDLE. I don't see any "Invalid handle." in log file. This handle doesn't null in windows x86.
• There is a windows process "CredentialUIBroker.exe" that attached to minidriver in windows 8.1: " DLLMain Attach ModuleFileName=C:\Windows\System32\CredentialUIBroker.exe "
  Is there any affect from this process on fail SLL?

[dengert]

If you use FireFox and use the opensc-pkcs11.dll as a security device, does the SSL login fail?

On 8/30/2015 4:09 AM, ROZOH wrote:

Hi.
I have a fail login in IE SSL in windows 7 x64 and windows 8.1 x64. IE detects certificate but does not match with smart card attached.

Do you mean IE found a good certificate in the certificate store, but it can not fine the smartcard that should contain the matching key?
Sounds like a caching issue as reported in #524

Are you testing cards, and are updating the card(s) but not changing serial numbers, or not clearing out the certificate store?

certutil.exe can be useful, as one of the options is to verify that the certificate matches the key on the card.

I'm checking minidriver log file. There is two case that is vague for me.

• Both windows have pCardData->hScard = 0x00000000 but CardAcquireContext does not return SCARD_E_INVALID_HANDLE. I don't see any "Invalid handle." in log file. This handle doesn't null in windows x86.

This could be a problem with the debug output where logprintf use 0x%08X to print the handle. On a 64 bit machine, may be 64bit pointer.

What is windows x86? XP? W7 32bit? W8 32bit?

Windows passes in the hScard handle used to contact PCSC. It may change the handle from time to time and the minidriver
calls check_reader_status to see if it changed.

More of the mindriver log would help.

• There is a windows process "CredentialUIBroker.exe" that attached to minidriver in windows 8.1: " DLLMain Attach ModuleFileName=C:\Windows\System32\CredentialUIBroker.exe " Is there any affect
  from this process on fail SLL?

probably not. Google for CredentialUIBroker.exe
or Credential Broker.

—
Reply to this email directly or view it on GitHub #536.

Douglas E. Engert [email protected]

[ROZOH]

If you use FireFox and use the opensc-pkcs11.dll as a security device, does the SSL login fail?

No, in these cases SSL Login is successful. Firefox uses pkcs11 dll for SSL.

Do you mean IE found a good certificate in the certificate store, but it can not fine the smartcard that should contain the >matching key?

Exactly.

Sounds like a caching issue as reported in #524
Are you testing cards, and are updating the card(s) but not changing serial numbers, or not clearing out the certificate store?

No, There isn't any cache problem. I'm using one card. I reboot the system before a test so there isn't any cache problem.

certutil.exe can be useful, as one of the options is to verify that the certificate matches the key on the card.

certutil -scinfo command has a successfull result. keys matches with the card.

This could be a problem with the debug output where logprintf use 0x%08X to print the handle. On a 64 bit machine, may be >64bit pointer.
What is windows x86? XP? W7 32bit? W8 32bit?
Windows passes in the hScard handle used to contact PCSC. It may change the handle from time to time and the minidriver
calls check_reader_status to see if it changed.

I have a question. Will fail CardReadFile or CardAuthenticatePin if hScard was 0 or NULL? Generally, SSL login failed if hScard was 0?

[dengert]

Don't know.

What I was saying about the logprintf used in the debug log is it is only printing 4 bytes of hScard. If your question is based on seeing pCardData->hScard = 0x00000000 in the log may be missleading because on a 64 bit machine I think hScard is actually 8 bytes. So it may not be zero at all.

Do you have both the 64 bit and 32 bit versions on OpenSC installed on the 64 bit machine?

I see on my W7, the certutil.exe run as 64 bit, but taskmanager shows both 32 and 64 bit versions running.
Google for: iexplore.exe 32 64
http:https://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/i-have-windows-7-64-bit-and-need-to-use-internet/babaa5f8-ff06-4ea2-aef6-a9416d65f981
says:
If it's a Win7 64-bit computer, you have two versions of Internet Explorer: IE 32-bit (the default) and IE 64-bit (cannot be the default). Shortcuts to both should be listed in your Start menu.

If you don't have the 32 bit OpenSC, iexplore.exe *32 may never see the smartcard.

[ROZOH]

Yes, there are 32 and 64 bits version of opensc in my system.

[ROZOH]

Are you know that what namespace used in IE to working with certificates? is it "System.Security." or "Windows.Security."?
Are there problems with Cryptographic APIs in windows 8?

[dengert]

Don't know the answer to your questions. Maybe other developers do?

But these might be helpful.
http:https://www.microsoft.com/en-us/download/details.aspx?id=30688
https://technet.microsoft.com/en-us/library/Dn344918.aspx
https://msdn.microsoft.com/en-us/library/windows/hardware/dn468773(v=vs.85).aspx

In regards to the title of this issue
pCardData->hScard is NULL!

I suggested that the hScard may not be NULL, because the printf format for the handle is wrong.
Have you tried replacing in minidriver.c any printf format for the hScard of 0x%08X with 0x%p
I believe the handle is the same size as a pointer. Can you check this out?

If you want to get other developers to answer your questions, use the Github history and blame feature on minidriver.c
to see who made changes. This can also give you an idea of the expertise of the developer.
Then use the Github @name to make sure they get your message.

I no longer use the minidriver and have had a build environment since 2013. I have never run the minidriver on Windows 8.

The last change I made to the minidriver was in 2011,
0a9d507

This commit got the minidriver to work by using the handles passed to it and added the
associate_card and disassociate_card and check_reader_status. These may need some work.
(I can give more details if you want to make the changes.)

On 9/2/2015 12:38 AM, ROZOH wrote:

Are you know that what namespace used in IE to working with certificates? is it "System.Security." or "Windows.Security."?
Are there problems with Cryptographic APIs in windows 8?

—
Reply to this email directly or view it on GitHub #536 (comment).

Douglas E. Engert [email protected]

[ROZOH]

@vletoux Can you help me?
There is a mismatch between certificate and smart card in windows 8.1 in IE SSL.
Also, If I construct X509Certificate2 object from selected certificate, PrivateKey member of it is NULL, so there isn't CspKeyContainerName. sample code returns "there isn't Key set " exception. It is the same mismatch in IE detect related reader.

[vletoux]

I've added a specifc check to assert that hSCard is not NULL. I think it is a display issue.
The only case allowed is when secure key injection is used. But it fails with the good error code (not supported).
https://github.com/OpenSC/OpenSC/blob/master/src/minidriver/minidriver.c#L4524

If certutil -scinfo display the certificate, that means that the minidriver is working perfectly.

Whe you say "There is a mismatch between certificate and smart card in windows 8.1 in IE SSL. " you means to you got a certutil -scinfo warning about that. Correct ?
If it is the case, that means that the public key shown in the certificate in not the same than the public key in the public/private key container on the smart card.
This won't work until the public keys are the same.

Building a X509Certificate2 object means that you have basically a certificate WITHOUT its private key reference. That is normal that PrivateKey is null because it is build automatically only when using a P12 file.

You have to initialze this member yourself with an instance of the class RSACryptoServiceProvider prov. Then in the CSPParameter, you have to provide the container name (the smart card slot) and the CSP name (with openSC "OpenSC"). I already made a comment in a previous issue about that.

Vincent

[vletoux]

IE is not using dotnet (X509Certificate2) but rather directly CryptoAPI 1 (and 2 ?).
X509Certificate2 is using CryptoAPI 2 I think.
The minidriver can be used by both CryptoAPI 1 (via a CSP) and CryptoAPI 2 (via a KSP)

=> certutil -scinfo is the best tool to debug login / IE issues related to smart cards

[vletoux]

Is CredentialUIBroker.exe the program used to collect the PIN for the minidriver when the policy "collect the PIN on a secure desktop" is active ?

[ROZOH]

Is CredentialUIBroker.exe the program used to collect the PIN for the minidriver when the policy "collect the PIN on a secure >desktop" is active ?

I don't know about CredentialUIBroker.exe, this program displayed in minidriver logs. Do you know about it?

[ROZOH]

IE is not using dotnet (X509Certificate2) but rather directly CryptoAPI 1 (and 2 ?).
X509Certificate2 is using CryptoAPI 2 I think.
The minidriver can be used by both CryptoAPI 1 (via a CSP) and CryptoAPI 2 (via a KSP)

@vletoux
I have this problem in windows 8.1 specially. IE displays personal certificates stores in certmgr. In select smart card step, I see two types of message in different win8 OS(s).

• "The smart card is ready for use." But after it PIN did not requested and "Access denied" in IE displayed.
• "A Smart card was detected but is not the one required for the current operation. The smart card you are using may be missing required driver software or a required certificate". So I can't continue.

=> certutil -scinfo is the best tool to debug login / IE issues related to smart cards

Can you help me more in this solution? certutil -scinfo is successful in detect smart card and certificates. Are you have specific command for test? or related to IE issues?

[vletoux]

Can you add screenshot to your ticket ? (I have to check the status of the buttons)

[ROZOH]

Can you add screenshot to your ticket ?
(I have to check the status of the buttons)

Are you see my before comment? messages and state of buttons specified.

[vletoux]

And you didn't answer [Whe you say "There is a mismatch between certificate and smart card in windows 8.1 in IE SSL. " you means to you got a certutil -scinfo warning about that. Correct ?]
The error message you see is typical of this error. Only the button status varies.

[ROZOH]

@vletoux

And you didn't answer [Whe you say "There is a mismatch between certificate and smart card in windows 8.1 in IE SSL. " >you means to you got a certutil -scinfo warning about that. Correct ?]

certutil -scinfo is successful in detect smart card and certificates. Are you mean specific result in command line?
I am comparing certutil -scinfo in windows 7 and windows 8, There are diffirences in CERT_CHAIN_CONTEXT section:
....................................................................................................................................................
Windows 8.1:
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwRevocationFreshnessTime: 1 Weeks, 1 Hours, 35 Minutes, 26 Seconds

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwRevocationFreshnessTime: 1 Weeks, 1 Hours, 35 Minutes, 26 Seconds

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
..................................................................................................................................................
Windows 7:
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwErrorStatus = CERT_TRUST_IS_PARTIAL_CHAIN (0x10000)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_PARTIAL_CHAIN (0x10000)

CertContext[0][0]: dwInfoStatus=2 dwErrorStatus=1000040
.........................................................................................................................................................

There is difference between "Exclude leaf cert" and "Full chain" values in 2 windows.
In windows 7 "Full Chain" is sha1 or thumbprint of certificate while in windows 8 has a diffirent value.

last result line In windows 7 is: "A certificate chain could not be built to a trusted root authority. 0x800b010a (-2146762486)"
While in windows 8 is: "The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)"

[vletoux]

You definitively have not a public key matching problem because you should have seen a message in certutil saying that the public key between the certificate and the smart card didn't match.

It's hard to help you:
There is no screenshot, nor logs. For example I do not even know the smart card brand.

Did you activate the "Prompt for credentials on the secure desktop" policy ?

[ROZOH]

@vletoux
certutil -scinfo Logs:

Microsoft Windows Version 6.3.9600 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
0: SecCard Smart Card Reader 0
--- Reader: SecCard Smart Card Reader 0
--- Status: SCARD_STATE_PRESENT
--- Status: The card is available for use.
--- Card: SecCard sec Smart Card
--- ATR:
3b e3 01 00 64 21 34 78 50 01 c0 90

Analyzing card in reader: SecCard Smart Card Reader 0

--------------===========================--------------
================ Certificate 0 ================
--- Reader: SecCard Smart Card Reader 0
--- Card: SecCard sec Smart Card
Provider = Microsoft Base Smart Card Crypto Provider
Key Container = le-SignAndEncryptionSmartcardUser-18807 [Default Container]

No AT_SIGNATURE key for reader: SecCard Smart Card Reader 0
Serial Number: 6121a22b00000000007e
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
NotBefore: 8/21/2015 6:03 AM
NotAfter: 8/20/2016 6:03 AM
Subject: E=[email protected], CN=user4, CN=Users, DC=sec, DC=usa
Non-root Certificate
Template: 1.3.6.1.4.1.311.21.8.8646690.14092465.11486634.9100702.11713107.214.51
97260.2065176, Sign And Encryption Smartcard User
Cert Hash(sha1): 9d f5 24 60 8a 1c 19 cd 53 22 44 1a 4e 3e a1 c4 b6 52 1b 43

Performing AT_KEYEXCHANGE public key matching test...
Public key matching test succeeded
Key Container = le-SignAndEncryptionSmartcardUser-18807
Provider = Microsoft Base Smart Card Crypto Provider
ProviderType = 1
Flags = 1
0x1 (1)
KeySpec = 1 -- AT_KEYEXCHANGE
Private key verifies

Performing cert chain verification...
CertGetCertificateChain(dwErrorStatus) = 0x1000040
Chain on smart card is invalid
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
ChainContext.dwRevocationFreshnessTime: 1 Weeks, 1 Hours, 35 Minutes, 26 Seconds

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
SimpleChain.dwRevocationFreshnessTime: 1 Weeks, 1 Hours, 35 Minutes, 26 Seconds

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=1000040
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
NotBefore: 8/21/2015 6:03 AM
NotAfter: 8/20/2016 6:03 AM
Subject: E=[email protected], CN=user4, CN=Users, DC=sec, DC=usa
Serial: 6121a22b00000000007e
SubjectAltName: Other Name:Principal Name=[email protected], RFC822 Name=user4@k
eya.com
Template: Sign And Encryption Smartcard User
431b52b6c4a13e4e1a442253cd191c8a6024f59d
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x1000000)
CRL 18:
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
ThisUpdate: 8/26/2015 3:20 AM
NextUpdate: 9/2/2015 3:40 PM
b2695610cfed23dec3a3916b45cb1cdd8146df7f
Delta CRL 1b:
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
ThisUpdate: 8/29/2015 10:31 PM
NextUpdate: 8/31/2015 10:51 AM
938e02c28a1e74c2325aa1b4c017ab232a6ac152
Application[0] = 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
Application[1] = 1.3.6.1.5.5.7.3.2 Client Authentication
Application[2] = 1.3.6.1.5.5.7.3.4 Secure Email

CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
NotBefore: 7/15/2015 6:00 AM
NotAfter: 7/15/2020 6:10 AM
Subject: CN=sec-WIN-CA, DC=sec, DC=usa
Serial: 4d1cd8175df48a9b5d88b12f1336ac8a
387a6137794a696094bb2b9a4b9644138d53f7b3
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

Exclude leaf cert:
186e3d1221be94fca326411d4e67fa73227ac1e1
Full chain:
f154f180212e4329396213713adc081aa07212a5
Issuer: CN=sec-WIN-CA, DC=sec, DC=usa
NotBefore: 8/21/2015 6:03 AM
NotAfter: 8/20/2016 6:03 AM
Subject: E=[email protected], CN=user4, CN=Users, DC=sec, DC=usa
Serial: 6121a22b00000000007e
SubjectAltName: Other Name:Principal Name=[email protected], RFC822 Name=user4@k
eya.com
Template: Sign And Encryption Smartcard User
431b52b6c4a13e4e1a442253cd191c8a6024f59d

The revocation function was unable to check revocation because the revocation server was offline.0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)

Revocation check skipped -- server offline
Displayed AT_KEYEXCHANGE cert for reader: SecCard Smart Card Reader 0
SCardGetCardTypeProviderName: The system cannot find the file specified. 0x2 (WI
N32: 2 ERROR_FILE_NOT_FOUND)
Cannot retrieve Provider Name for SecCard sec Smart Card
--------------===========================--------------

Done.
CertUtil: -SCInfo command completed successfully.

[vletoux]

The error shown highlighted means that your computer can't connect to the CRL / OCSP server to check if the certificate has been revoked. It is not a problem when using with IE.

But are you using really OpenSC ?
Because the crypto provider is "Microsoft Base Smart Card Crypto Provider" (instead of "OpenSC" in the latest version) and the card name is "SecCard sec Smart Card" which is on my opinion not a card supported by OpenSC

[ROZOH]

The error show highlight means that your computer can't connect to the CRL / OCSP server to check if it has been revoked. It >is not a problem when using with IE.

This line was bold by this site.

Are you using really OpenSC ?

Yes, I'm using opensc version 12.0.2 . If minidriver of opensc don't introduce in registry file and don't install on system, certutil -scinfo won't work.

[vletoux]

The latest version is 15.0.

I'm sure you'll understand that I won't be able to help you until you upgrade to the latest version.

[ROZOH]

The latest version is 15.0.
I'm sure you'll understand that I won't be able to help you until you upgrade to the latest version.

Ok I have a question, Are you think there is a problem in opensc version? opensc's minidriver version 15.0 doesn't relate to base csp?

[vletoux]

I did a lot of work in fixing potential issues