PKCS11 certificate on smartcard not recognised

Domenl

Works great when certificate in imported in keychain, but the certificate is not found/recognized when stored on an external smart card (in this case a Yubikey NEO).

Safari has the same behaviour.

Certificate stored on smartcard should be loaded and available to select.

Version 0.99.130.2-beta (WebKit 621.1.2.111.4) on M1 Pro MacOS 15.2

Sequoia (15)

gp

The issue at hand here is that Safari-based browsers don't "do" third party middleware drivers. Firefox does, but is quite unusual in supporting that I believe.

For example, https://github.com/OpenSC/OpenSC/wiki/Installing-OpenSC-PKCS11-Module-in-Firefox,-Step-by-Step - this is how the process of loading in a third party PKCS11 driver works in Firefox.

There are some other limitations on Orion's client certificate support right now as well (that are not replicated in Safari) - I guess that not many users are using client certs. e.g. https://orionfeedback.org/d/6670-connections-to-wss-websocket-secure-do-not-appear-to-work-with-tls-client-certificates-enabled

Yannick

Hey,

Since we are using Safari's rendering engine, we can't really help you with that. The best thing is to redo your bug report (sorry) to Webkit, which manages the Safari/Orion engine.

→ https://bugs.webkit.org

Valinwolf

I came here to report this bug, however it seems y’all are saying it’s a WebKit issue. I don’t have this issue on other WebKit browsers on iOS, including safari and chrome (iOS requires WebKit backend). Orion is the only browser I have used on iOS that cannot open the certificate selection dialog for smart cards, such as CAC and YubiKey.

I say this to ask, why is this a problem with WebKit?

Yannick

Chrome is not a Webkit-based browser and Safari has extra privileges on the device. We're stuck.

Valinwolf

Yannick To the contrary, unless you live in the EU, all browsers on iOS are required to run WebKit under the hood. That includes Chrome.

Yannick

Oh.. I didn't know that, thanks. And yeah, many of us are in Europe.