Posted  by 

Scr3310 Cac Card Reader Driver For Macadvantageload

This is a guide that is tested to work with Ubuntu and its Derivatives including Linux Mint. Note that not all derivatives were tested.

The SCR3310V2 is a widely used 'CAC Reader' for the Department of Defense Common Access Card (CAC Card). It can also be used for PIV, PIV-I, TWIC and other federal governemnt ID cards. Full support and compliance to EMV 2011 and GSA FIPS 201 expands daily use to applications requiring additional security and data protection. SCM's SCR3310 and SCR3310v2.0 are small and ergonomic USB smart card readers, with backside mounting holes. The readers are ISO 7816 compliant, and can be used for cards in ID 1 card format. Update your SmartCardReader USB drivers for model SCR3310.SCM's SCR3310 and SCR3310v2.0 are small and ergonomic USB smart card readers, with backside mounting holes. The readers are ISO 7816 compliant, and can be used for cards in ID 1 card format.

If you test this against an Ubuntu derivative and it works or does not work, please contact me and let me know.

Preface

US Department of Defense (DoD) now limits access to many of its websites to be via a smart Common Access Card (CAC) authenticated with a Personal Identification Number (PIN). The following is a guide to assist in setting up Linux Mint to access CAC-enabled DoD websites.

Install the Middleware

The Linux CAC Reader stack is based on a set of middleware called PCSC (Personal Computer Smart Card), written by the MUSCLE (Movement for the Use of Smart Cards in a Linux Environment) project.

Enter this into Terminal and execute:

PKCS #11 module

There are three working modules to access the PKCS #11 keys on your CAC. Each have their strengths and limitations. You will need to choose which version works best for you. In most situations, OpenSC is preferred.

OpenSC

OpenSC provides a set of utilities to access smart cards. It facilitates their use in security applications such as mail encryption, authentication, and digital signature. This module has a broader feature set than CoolKey or CACkey and you are able to access your PIV certificate for those individuals that are Dual Persona. This module is speedy like CoolKey and doesn’t lag like CACkey. This may be the best option if you are dual persona and do not wish to use CACkey from DISA.

sudo apt install opensc

Smart Card Reader Driver

Without installing any additional drivers the following card readers are tested and work without issue: SCR3310 by SCM Microsystems (Currently being issued to members by the US Army for use on personal computers) SCR3500 by SCM Microsystems (Many members purchase this as a more compact alternative to the SCR3310) O2 Micro, Inc (built-in to many Dell laptops)

You may have to install additional drivers for your hardware. Check your hardware and search using the key word pcsc.

Start Up the Daemon

In Terminal:

sudo systemctl start pcscd
sudo systemctl enable pcscd

Testing your Smart Card Driver

Open a terminal (ie konsole, x-term or other) and type/enter. You might have to insert a smart card in order for the message to pop-up.

pcsc_scan

Similar to the following means the card reader is working properly:

PC/SC device scanner V 1.4.18 (c) 2001-2011, Ludovic Rousseau <[email protected]> Compiled with PC/SC lite version: 1.8.8 Using reader plug’n play mechanism Scanning present readers… 0: O2 Micro Oz776 00 00 Sun Mar 24 11:40:07 2013 Reader 0: O2 Micro Oz776 00 00 Card state: Card removed

Similar to this indicates a need to check for additional driver requirements for your hardware:

PC/SC device scanner V 1.4.18 (c) 2001-2011, Ludovic Rousseau <[email protected]> Compiled with PC/SC lite version: 1.8.8 Using reader plug’n play mechanism Scanning present readers… Waiting for the first reader…

Authority Certificates

Download extract and install the DoD Certificates.

The certificates can be obtained from this link:

Make note of the location you stored these certificates

Configure Firefox

Firefox requires manual selection of the PKCS #11 module.

Import Certificates

The current method of installing the certificates is one-by-one. This can be done through Firefox import mechanism.

Firefox 57 and later

Preferences > Privacy & Security
Scroll Down to Security Section
Select View Certificates

Continue for All versions of Firefox

Select the Import… button at the bottom of the dialog and install the following certificates.

  • DOD CA-27 through DOD CA-32
  • DOD EMAIL CA-27 through DOD EMAIL CA-34,
  • DOD EMAIL CA-39 through DOD EMAIL
  • CA-44,DOD ID CA-33 through DOD ID
  • CA-34,DOD ID CA-39 through DOD ID CA-44,
  • DOD ID SW CA-35 through DOD ID SW CA-38,DOD
  • ID SW CA-45 through DOD ID SW CA-48
  • DoD Root CA 2 through DoD Root CA 4

Set Firefox to Require Selection of Certificate

When accessing multiple CAC protected pages, some pages will require different certificates from the card. Some require the non-email certificate while Enterprise Email will require the email certificate.

Preferences > Privacy & Security
Scroll Down to Security Section
Below the Certificates heading, select the radio button in front of “Ask me every time.”
Set CAC Module

CAC Module Setup

Open Preferences > Privacy & Security
Scroll Down to Security Section
Select Security Devices

Check the left column. It should show an entry similar to “CAC Module” along with certificate(s) as a sub-item. If it doesn’t work then the entries are wrong.
Select the entry and select Unload to remove the security device

To install/reinstall the CAC driver in Firefox using the above listed Security Devices
Select Load on the dialog box

Module name should be something like: DoD CAC

Module filename: either type in or browse to the location of the opensc-pkcs11.so drivers

Example:

/usr/lib/pkcs11/opensc-pkcs11.so

Configure Chrome / Chromium

Unfortunately, Chrome (Chromium) doesn’t automatically recognize the CAC once you’ve completed all the previous steps but it doesn’t take much more work to get Chrome to work with the CAC.

In Terminal:

modutil -dbdir sql:.pki/nssdb/ -add 'CAC Module' -libfile /usr/lib/pkcs11/opensc-pkcs11.so

Make sure that the utility is properly installed, in Terminal:

modutil -dbdir sql:.pki/nssdb/ -list

If it is properly installed there will be an entry with “CAC Module” and details of the library, slot and status. If you were not in your home directory when configuring modutil you will receive an error like:

“modutil: function failed: SEC_ERROR_BAD_DATABASE: security library: bad database.”

Chrome should now be able to utilize the CAC without any issues

Removing CAC Module

If you have previously installed libcackey.so and you wish to utilize CoolKey instead, you will have to unload the “CAC Module”: modutil -dbdir sql:.pki/nssdb/ -delete “CAC Module”

Test out your browser

Card

Go to a CAC-enabled web site (www.us.army.mil) and test the CAC login.

Be patient as there may be a delay while authenticating with the CAC.

The PIN and certificate selection authentication process is in the reverse of what you may be used to when using non-Linux machines. Expect to be prompted first for PIN and then certificate selection.

Troubleshooting

At anytime if you don’t seem to get response from the Smart Card, check and see if the daemon is active by executing this in terminal:

pcsc_scan

If you remove and insert your card with no response during the scan, the daemon has crashed.

If you find that the pcsc daemon has crashed you can run this in terminal to restart the daemon:

sudo systemctl restart pcscd

External Links

NOTE:

Between mid October 2019 and mid February 2020 everyone in the Army was migrated to use their PIV Authentication certificate for Email access. You no longer use the Email certificate for Enterprise Email or any CAC enabled websites

Mac users who choose to upgrade (or already have upgraded) to Mac OS Catalina (10.15.x) or Big Sur (11.xx.x) will need to uninstall all 3rd Party CAC enablers per https://militarycac.com/macuninstall.htm AND reenable the native smart card ability (very bottom of macuninstall link above)

If you purchased your Mac with OS Catalina (10.15.x) or Big Sur (11.xx.x) already installed, you can skip the uninstall part above and follow the instructions below.

6 'high level' steps needed, follow down the page to make this a painless systematic process

1.Is your CAC reader 'Mac friendly'?
2.Can your Mac 'see' the reader?
3.Verify which version of Mac OS you have
4.Figure out which CAC (ID card) you have
5.Install the DoD certificates
5a.Additional DoD certificate installation instructions for Firefox users
6.Decide which CAC enabler you want to use (except for 10.12-.15 & 11)

Step 1: Is your CAC reader Mac friendly?

Visit the USB Readers page to verify the CAC reader you have is Mac friendly.

Visit the USB-C Readers page to verify the CAC reader you have is Mac friendly.

'Some, not all' CAC readers may need to have a driver installed to make it work.

NOTE: Readers such as: SCR-331 & SCR-3500A may need a firmware update (NO OTHER Readers need firmware updates).

Information about these specific readers are in Step 2

Step 2: Can your Mac 'see' the reader?

Plug the CAC reader into an open USB port before proceeding, give it a few moments to install

Step 2a: Click the Apple Icon in the upper left corner of the desktop, select 'About This Mac'

Step 2b: Click 'System Report..' (button)

Step 2c: Verify the CAC reader shows in Hardware, USB, under USB Device Tree. Different readers will show differently, most readers have no problem in this step. See Step 2c1 for specific reader issues.

Step 2c1: Verify firmware version on your SCR-331, SCR-3310 v.20, GSR-202, 202V, 203, or SCR-3500a reader. If you have a reader other than these 6, Proceed directly to step 3

Step 2c1a-SCR-331 reader

If your reader does not look like this, go to the next step.

In the 'Hardware' drop down, click 'USB.' On the right side of the screen under 'USB Device Tree' the window will display all hardware plugged into the USB ports on your Mac. Look for “SCRx31 USB Smart Card Reader.” If the Smart Card reader is present, look at 'Version' in the lower right corner of this box: If you have a number below 5.25, you need to update your firmware to 5.25. If you are already at 5.25, your reader is installed on your system, and no further hardware changes are required. You can now Quit System Profiler and continue to Step 3.

Step 2c1b-SCR-3310 v2.0 reader

If your reader does not look like this, go to the next step.

In the 'Hardware' drop down, click 'USB.' On the right side of the screen under 'USB Device Tree' the window will display all hardware plugged into the USB ports on your Mac. Look for “SCR3310 v2.0 USB Smart Card Reader.” If the Smart Card reader is present, look at 'Version' in the lower right corner of this box: If you have a number below 6.02, it will not read the 'G+D FIPS 201 SCE 7.0' CAC on Mac OS 11.xx.x or 10.15.7. I contacted HID (the company that makes these readers) on 14 DEC 2020 to find a way to update the firmware to 6.02. They said there is not firmware update for the reader. If your reader is older, you may need a new one. Please look at: https://militarycac.com/usbreaders.htm to find a compatible one. If you are already at version 6.02, your reader should work fine on your Mac and no further hardware changes are required. You can now Quit System Profiler and continue to Step 3.

Step 2c1c-SCR-3500A reader

If you have the SCR3500A P/N:905430-1 CAC reader,you may need to install this driver, as the one that installs automatically will not work on most Macs. Hold the control key [on your keyboard] when clicking the .pkg file [with your mouse], select [the word] Open

Step 3: Verify which version of MacOS you have?

(You need to know this information for step 6)

Step 3a: Click the Apple Icon in the upper left corner of your desktop and select 'About This Mac'

Step 3b: Look below Mac OS X for: Example: Version 10.X.X, or 11.X

Step 4: Figure out which CAC (ID Card) you have

(You need to know this information for step 6)

Look at the top back of your ID card for these card types. If you have any version other than the six shown below, you need to visit an ID card office and have it replaced. All CACs [other than these six] were supposed to be replaced prior to 1 October 2012.

Find out how to flip card over video

Step 5: Install the DoD certificates (for Safari and Chrome Users)

Go to Keychain Access

Click: Go (top of screen), Utilities, double click Keychain Access.app

(You can also type: keychain access using Spotlight (this is my preferred method))

Select login (under Keychains),and All Items (under Category).

Download the 5 files via links below (you may need to <ctrl> click, select Download Linked File As.. on each link) Save to your downloads folder

Please know.. IF You have any DoD certificates already located in your keychain access, you will need to delete them prior to running the AllCerts.p7b file below.

https://militarycac.com/maccerts/AllCerts.p7b,

https://militarycac.com/maccerts/RootCert2.cer,

https://militarycac.com/maccerts/RootCert3.cer,

https://militarycac.com/maccerts/RootCert4.cer, and

Double click each of the files to install certificates into the login section of keychain

Select the Kind column, verify the arrow is pointing up, scroll down to certificate, look for all of the following certificates:

DOD EMAIL CA-33 through DOD EMAIL CA-34,

DOD EMAIL CA-39 through DOD EMAIL CA-44,

DOD EMAIL CA-49 through DOD EMAIL CA-52,

DOD EMAIL CA-59,

DOD ID CA-33 through DOD ID CA-34,

Th sound pronunciationielts document. DOD ID CA-39 through DOD ID CA-44,

DOD ID CA-49 through DOD ID CA-52,

DOD ID CA-59

DOD ID SW CA-35 through DOD ID SW CA-38,

DOD ID SW CA-45 through DOD ID SW CA-48,

DoD Root CA 2 through DoD Root CA 5,

DOD SW CA-53 through DOD SW CA-58, and

DOD SW CA-60 through DOD SW CA-61

NOTE: If you are missing any of the above certificates, you have 2 choices,

1. Delete all of them, and re-run the 5 files above, or

2. Download the allcerts.zip file and install each of the certificates you are missing individually.

Errors:

Error 100001 Solution

Error 100013 Solution

You may notice some of the certificates will have a red circle with a white X . This means your computer does not trust those certificates

You need to manually trust the DoD Root CA 2, 3, 4, & 5 certificates

Double click each of the DoD Root CA certificates, select the triangle next to Trust, in the When using this certificate: select Always Trust, repeat until all 4 do not have the red circle with a white X.

You may be prompted to enter computer password when you close the window

Once you select Always Trust, your icon will have a light blue circle with a white + on it.

The 'bad certs' that have caused problems for Windows users may show up in the keychain access section on some Macs. These need to be deleted / moved to trash.

The DoD Root CA 2 & 3 you are removing has a light blue frame, leave the yellow frame version. The icons may or may not have a red circle with the white x

or DoD Interoperability Root CA 1 or CA 2 certificate
DoD Root CA 2 or 3 (light blue frame ONLY) certificate
or Federal Bridge CA 2016 or 2013 certificate
or Federal Common Policy CAcertificate
or or SHA-1 Federal Root CA G2 certificate
or US DoD CCEB Interoperability Root CA 1 certificate

If you have tried accessing CAC enabled sites prior to following these instructions, please go through this page before proceeding

Clearing the keychain (opens a new page)

Please come back to this page to continue installation instructions.

Step 5a: DoD certificate installation instructions for Firefox users

NOTE: Firefox will not work on Catalina (10.15.x), or last 4 versions of Mac OS if using the native Apple smartcard ability

Download AllCerts.zip, [remember where you save it].

double click the allcerts.zip file (it'll automatically extract into a new folder)

Option 1 to install the certificates (semi automated):

From inside the AllCerts extracted folder, select all of the certificates

<control> click (or Right click) the selected certificates, select Open With, Other..

In the Enable (selection box), change to All Applications

Select Firefox, then Open

You will see several dozen browser tabs open up, let it open as many as it wants.

You will eventually start seeing either of the 2 messages shown next

If the certificate is not already in Firefox, a window will pop up stating 'You have been asked to trust a new Certificate Authority (CA).'

Check all three boxes to allow the certificate to: identify websites, identify email users, and identify software developers

Driver

or

'Alert This certificate is already installed as a certificate authority.' Click OK

Once you've added all of the certificates..
• Click Firefox (word) (upper left of your screen)
• Preferences
• Advanced (tab)
• Press Network under the Advanced Tab
• In the Cached Web Content section, click Clear Now (button).
• Quit Firefox and restart it

Option 2 to install the certificates (very tedious manual):

Click Firefox (word) (upper left of your screen)

Preferences

Advanced (tab on left side of screen)

Certificates (tab)

View Certificates (button)

Authorities (tab)

Import (button)

Browse to the DoD certificates (AllCerts) extracted folder you downloaded and extracted above.

Note: You have to do this step for every single certificate

Note2: If the certificate is already in Firefox, a window will pop up stating: 'Alert This certificate is already installed as a certificate authority (CA).' Click OK

Note3: If the certificate is not already in Firefox, a window will pop up stating 'You have been asked to trust a new Certificate Authority (CA).'

Check all three boxes to allow the certificate to: identify websites, identify email users, and identify software developers

Once you've added all of the certificates..
• Click Firefox (word) (upper left of your screen)
• Preferences
• Advanced (tab)
• Press Network under the Advanced Tab
• In the Cached Web Content section, click Clear Now (button).
• Quit Firefox and restart it

Step 6: Decide which CAC enabler you can / want to use

Only for Mac El Capitan (10.11.x or older)

Cac Card Reader Scr3310v2 Driver

After installing the CAC enabler, restart the computer and go to a CAC enabled website

Cac Card Reader Scr3310 Software For Mac

NOTE: Mac OS Sierra (10.12.x), High Sierra (10.13.x), Mojave (10.14.x), Catalina (10.15.x), and Big Sur (11.1) computers no longer need a CAC Enabler.

Try to access the CAC enabled site you need to access now

Software For Scr3310 Cac Card Reader

Mac support provided by: Michael Danberry