Links and Overview

Software

Scdaemon

Note: See also GnuPG-PKCS11-scd for a scdaemon replacement that uses PKCS#11 modules.

$ gpgsm --learn-card
gpgsm: NOTE: THIS IS A DEVELOPMENT VERSION!
gpgsm: It is only intended for test purposes and should NOT be
gpgsm: used in a production environment or with production keys!
gpgsm: can't connect to `/tmp/gpg-C0x9MY/S.gpg-agent': No such file or directory
gpgsm: can't connect to the agent - trying fall back
gpgsm: can't connect to `/home/benchoff/.gnupg/S.gpg-agent': No such file or directory
scdaemon[18273]: NOTE: this is a development version!
*** glibc detected *** free(): invalid pointer: 0xbfebda64 ***
scdaemon[18273]: reader slot 0: active protocol:
scdaemon[18273]: slot 0: ATR=3B E2 00 FF C1 10 31 FE 55 C8 02 9C
scdaemon[18273.0x8081a78] DBG: -> OK GNU Privacy Guard's Smartcard server ready
scdaemon[18273.0x8081a78] DBG: <- SERIALNO
scdaemon[18273]: DBG: send apdu: c=00 i=A4 p0=00 p1=0C lc=2 le=-1
scdaemon[18273]: DBG:   PCSC_data: 00 A4 00 0C 02 3F 00
scdaemon[18273]: error receiving PC/SC TRANSMIT response: premature EOF
scdaemon[18273]: apdu_send_simple(0) failed: card I/O error
scdaemon[18273]: no supported card application found: General error
scdaemon[18273.0x8081a78] DBG: -> ERR 100663356 Not supported <SCD>
gpg-agent[18272]: command learn failed: Not supported
gpgsm: error learning card: Not supported
scdaemon[18273.0x8081a78] DBG: <- RESET
scdaemon[18273.0x8081a78] DBG: -> OK
scdaemon[18273.0x8081a78] DBG: <- [EOF]

GpgAgent

DirMngr

DirMngr is a server for managing and downloading certificate revocation lists (CRLs) for X.509 certificates and for downloading the certificates themselves. DirMngr also handles OCSP requests as an alternative to CRLs. DirMngr is either invoked internally by gpgsm or when running as a system daemon through the dirmngr-client tool.

\# mkdir /etc/dirmngr
\# mkdir /var/run/dirmngr
\# mkdir -p /var/lib/cache/dirmngr/crls.d
\# # be sure certs are in /etc/dirmngr/trusted-certs as DER files named with .crt.
\# dirmngr --daemon --verbose --allow-ocsp
dirmngr[8988]: listening on socket `/var/run/dirmngr/socket'
dirmngr[8989]: certificate `/etc/dirmngr/trusted-certs/vtc1sca.crt' loaded
dirmngr[8989]: SHA1 fingerprint = E4:6F:B9:58:B7:85:CB:DB:93:B6:86:5B:F8:A9:83:7A:B0:B7:D0:27
dirmngr[8989]: certificate `/etc/dirmngr/trusted-certs/vtrootca.crt' loaded
dirmngr[8989]: SHA1 fingerprint = AF:6F:EB:42:FA:2F:E4:A2:6E:9F:7F:B5:B5:FF:3A:BC:13:C6:0D:81
dirmngr[8989]: certificate `/etc/dirmngr/trusted-certs/vtuserca.crt' loaded
dirmngr[8989]: SHA1 fingerprint = AC:01:D0:4E:23:08:93:BC:BA:F4:50:CA:15:58:2C:3A:88:40:B7:B7
dirmngr[8989]: can't access directory `/var/lib/lib/dirmngr/extra-certs': No such file or directory
dirmngr[8989]: permanently loaded certificates: 3
dirmngr[8989]:     runtime cached certificates: 0
DIRMNGR_INFO=/var/run/dirmngr/socket:8989:1; export DIRMNGR_INFO;
\# chmod og+w /var/run/dirmngr/socket

$ dirmngr-client --ping
dirmngr-client: a dirmngr daemon is up and running

$ dirmngr-client --verbose --pem --ocsp ~/vtc1sca.pem
dirmngr-client: certificate check failed: Configuration error

irmngr[8989]: handler for fd 0 started
dirmngr[8989]: no default OCSP responder defined
dirmngr[8989]: command CHECKOCSP failed: Configuration error
dirmngr[8989]: handler for fd 0 terminated

$ dirmngr-client --verbose --pem ~/vtc1sca.pem
dirmngr-client: certificate is valid

dirmngr[8989]: handler for fd 0 started
dirmngr[8989]: no CRL available for issuer id 4BDB4546CDBC3DC883FD037FBE3E14C2E174147C
dirmngr[8989]: update times of this CRL: this=20060920T163032 next=20160917T163032
dirmngr[8989]: note: non-critical certificate policy not allowed
dirmngr[8989]: creating cache file `/var/lib/cache/dirmngr/crls.d/crl-4BDB4546CDBC3DC883FD037FBE3E14C2E174147C.db'
dirmngr[8989]: opening cache file `/var/lib/cache/dirmngr/crls.d/crl-4BDB4546CDBC3DC883FD037FBE3E14C2E174147C.db'
dirmngr[8989]: S/N 03 is valid, it is not listed in the CRL
dirmngr[8989]: handler for fd 0 terminated

\# # With CRL in cache
dirmngr[8989]: handler for fd 0 started
dirmngr[8989]: S/N 03 is valid, it is not listed in the CRL
dirmngr[8989]: handler for fd 0 terminated

GpgSM

m-6:~/.gnupg (2)
$ gpg-agent10954: ssh handler 0x8082e80 for fd 0 started
gpg-agent10954: ssh request 20 is not supported
gpg-agent10954: ssh handler 0x8082e80 for fd 0 terminated
gpg-agent10954: ssh handler 0x8082e80 for fd 0 started
gpg-agent10954: ssh request 20 is not supported
gpg-agent10954: ssh handler 0x8082e80 for fd 0 terminated
noformat

GpgConf

Gnupg