Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[macOS] Chrome fails with ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED using Spanish DNIe (CTK/Tokend issue)

Aperta
  • Qualcosa non va?
#3,553 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
46/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
c, macos
Ambito
authentication, security

Direzione di ricerca

Start by tracing the macOS CryptoTokenKit/Tokend integration used by Chrome and Safari; the report does not identify a source file or test. Compare its signature handling with the working PKCS#11 path in Firefox, focusing on TLS signature algorithm and PSS-padding negotiation. Done means DNIe client-certificate authentication completes in Chrome with the reported reader and card, without breaking the working Firefox path.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug Input needed
Bug Report

System Information:

  • OS: macOS Tahoe 26.2
  • OpenSC Version: 0.26.1 (Installed via DMG installer)
  • Reader: ACS CCID USB Reader
  • Smart Card: Spanish DNIe (DNI electrónico 3.0/4.0)
  • Browser: Google Chrome (Latest stable)
Description of the Issue

I am trying to use the Spanish National ID (DNIe) to authenticate on government websites.

While OpenSC correctly detects the card and I have manually trusted the Intermediate CAs (AC DNIE 004) in the macOS Keychain, resulting in Chrome showing the certificate as "Valid" during selection, the authentication handshake fails immediately after selecting the certificate.

The Error:
Chrome displays: ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED.

It appears to be an issue with how OpenSC via the macOS CryptoTokenKit (CTK) bridge handles the signature request during the TLS handshake in Chrome (likely related to TLS 1.3 signature algorithms or PSS padding requirements not being correctly negotiated/passed to the OS).

Steps to Reproduce
  1. Install OpenSC via the official DMG installer on macOS.
  2. Connect an ACS CCID USB Reader and insert the Spanish DNIe.
  3. Verify detection with opensc-tool -n (Output: dnie).
  4. Ensure Root and Intermediate CAs (AC DNIE 004) are installed and set to "Always Trust" in macOS Keychain.
  5. Open Google Chrome and navigate to a site requiring client certificate authentication.
  6. Chrome prompts to select the certificate. Select the valid DNIe certificate.
  7. Result: The browser fails to complete the handshake and returns ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED.
Logs / Technical Details

opensc-tool -n output:

Using reader with a card: ACS CCID USB Reader
dnie

security list-smartcards output:
(Shows the card is recognized by the system)

Additional Context
  • Firefox works: If I use Firefox and manually load the PKCS#11 module (/Library/OpenSC/lib/opensc-pkcs11.so), authentication works perfectly. This confirms the card, reader, and OpenSC core library are functional.
  • Problem is isolated to System/Chrome integration: The issue only arises when relying on the system-wide integration (CTK/Tokend) used by Chrome/Safari.
  • The official proprietary driver from the Spanish Police (FNMT) does not work with this specific reader (ACS), so OpenSC is the only viable option for this hardware.
Lingua principale
C
Stelle
3.1k
Fork
858
Merge medio
4g 4h
PR unite (30g)
16

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OpenSC/OpenSC

Tutte le issue di OpenSC/OpenSC

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.