CRIPTOGRAFIA - FESP

Important : the --id has to be the exact same as the one you used to store the
client1.crt
(here:DC:EF:ED:19:74:73:DA:44:B6:A4:EE:F5:8B:1F:C5:43:33:2D:1F:A0)
Now, to access the key with openvpn you can use the following commands:
openvpn --show-pkcs11-slots /usr/lib/opensc-pkcs11.so
openvpn --show-pkcs11-objects /usr/lib/opensc-pkcs11.so 0
Note this part of the output (example from my test key):
You can access this token using
--pkcs11-slot-type "label" --pkcs11-slot "OpenSC Card (PKyves)" options.
And note also the subject for the client1 keyring. which in my example is:
Object
Type:
Certificate
CKA_ID:
dc ef ed 19 74 73 da 44 b6 a4 ee f5 8b 1f c5 43
33 2d 1f a0
CKA_LABEL:
Client1
subject:
/C=FR/ST=Ile-de-
France/L=Paris/O=Mandriva/CN=client1/emailAddress=ybourhis@mandriva.com
serialNumber: 03
notBefore:
060621144856Z
after having noted these down, I will modifie the client's configuratin file
(/etc/openvpn.client.conf) by removing the cert and key lines, and I'll replace
them with what follows:
pkcs11-providers /usr/lib/opensc-pkcs11.so
pkcs11-slot-type "label"
pkcs11-slot "OpenSC Card (PKyves)"
pkcs11-id-type subject
pkcs11-id "/C=FR/ST=Ile-de-
France/L=Paris/O=Mandriva/CN=client1/emailAddress=ybourhis@mandriva.com"
Now, each time the client is started, the PIN key will be asked before connection.
Next, Configure Shorewall or go back to the Table of contents
Client (PC2) Configuration:
urpmi openvpn
cd /etc/openvpn/
cp -r /usr/share/openvpn/sample-config-files/client.conf /etc/openvpn/
in case of self build rpm, replace the last command from above by:
cp -r /usr/share/doc/openvpn-2.x.x/sample-config-files/client.conf /etc/openvpn/