Electronic identification - ArchWiki

Jump to content

# Electronic identification

From ArchWiki

Related articles

- Common Access Card
- Smartcards

This article or section needs language, wiki syntax or style improvements. See Help:Style for reference.

Reason: Some duplication with Smartcards (Discuss in Talk:Electronic identification)

An electronic identification ("eID") is an electronic identification solution of citizens or organizations, for example in view to access benefits or services provided by government authorities, banks or other companies. Apart from online authentication many eICs also give users the option to sign electronic documents with a digital signature.

## Installation

Install the ccid package, all electronic identification requires this package. Then see #Hardware specific packages.

For pinentry support, install pinentry.

### Hardware specific packages

#### ACS smart cards

Install the acsccid package.

For more information about ACS smart cards, see [1].

#### Cr-75 card reader

Install the libcr75-gitAUR package for the device with the `1307:0361` ID.

## Belgium

### Installing the eID middleware

Import the (continuous build) keys from [2]. See makepkg#Signature checking. Install the eid-mwAUR package, then run:

    $ about-eid-mw

In the window that opens, the PCSC daemon status should be listed as "running". If it is not the case, start `pcscd.service`. Even if the service reports that it's socket activated or automatically started instead of "running", the service may need to be started manually.

### Installing the card reader's driver

Look at the brand of the card reader; there is a high chance it is ACS (Advanced Card System Ltd). If it is ACS, go to https://belgeid.be/en/product/acr38 and download the Linux driver. Follow the described install driver process.

### Installing the browser integration

#### Chrome/Chromium

Chrome does not need a plugin. Chromium require opensc and p11-kit as well. This article provides some instructions.

#### Firefox/Librewolf

A browser extension will need to be installed. Additionally, the eID module will need to manually be added to the Firefox security devices configuration. The steps are:

1. Open Firefox' settings.
2. Search for 'security devices'. Click the corresponding button.
3. In the popup, select 'Load'.
4. The second popup will ask for a file location. You can find this file by running `about-eid-mw` and looking for the "64-bit PKCS#11 location" value.

For Librewolf, also symlink the directories created by the middleware to `/usr/lib/librewolf/`, to avoid an error notification when starting Librewolf:

    # ln -s /usr/lib/mozilla/managed-storage /usr/lib/librewolf/managed-storage
    # ln -s /usr/lib/mozilla/pkcs11-modules /usr/lib/librewolf/pkcs11-modules

### General troubleshooting

A test page is available from the government to check if eID is configured correctly. Troubleshooting hints may be available in the official documentation, although Arch Linux is not officially supported.

Also note that using Flatpak or Snap is/was not supported, as those do not allow PKCS#11 modules such as eID to be loaded. Fixed for snap for all opensc readers: closed launchpad bug.

### Signing documents

Signing emails with Thunderbird and documents with LibreOffice is explained in a blog post by Luc Stroobant.

Depending on system configuration, it may be possible to run Adobe Reader DC under wine. The Belgium government has a relevant FAQ item on digital signatures.

If using Adobe Reader is not possible, the Belgian Federal Public Services' Signing Box offers an upload tool to sign PDFs. The website prompts to install two dependencies: an extra eID middleware beidconnectAUR and a browser extension.

Although okular and papers provide native support for digital PDF signing, signatures are not reported as valid by Signing Box. An open bug ticket exists for okular.

## Brazil (ICP-Brasil)

### SSL

Install ca-certificates-icp_brAUR as the Brazilian root CAs are not part of Mozilla's NSS due to a long standing issue.

The above package should be enough. If you have any issue, check [ITI's installation instructions https://www.gov.br/iti/pt-br/assuntos/navegadores] for Chromium, Firefox and other popular web browsers, and for Java.

### Smart Cards (A3 certificates)

1. Install safesignidentityclientAUR and opensc.

2. Start/enable `pcscd.service`

Note Having the "CAC Module" (`/usr/lib/opensc-pkcs11.so`) enabled can cause problems both in Firefox and Chrome

#### Firefox

Navigate to Edit > Preference > Advanced > Certificates > Security Devices and click "Load" to load a module using `/usr/lib/libaetpkss.so` and name it `ICP-Brasil A3 - Safe Sign Identity Client`.

Note Firefox may report the module did not load correctly however you will have to check in the security devices to confirm whether the module properly loaded or not

Test it by going to Receita Federal's e-CAC.

#### Chrome

Ensure Chrome is closed and run:

    $ modutil -dbdir sql:$HOME/.pki/nssdb/ -add "ICP-Brasil A3 - Safe Sign Identity Client" -libfile /usr/lib/libaetpkss.so

## Croatia

1. Start/enable `pcscd.service`
2. Install certiliamiddlewareAUR.
3. Launch the client. It is used for activating the card or changing the PINs or the PUK.

### Firefox

Navigate to Edit > Preference > Advanced > Certificates > Security Devices and click Load to load a module using `/usr/lib/akd/certiliamiddleware/pkcs11/libEidPkcs11.so`. You can assign any name to it, i.e. `Cro PKCS#11 Module`.

## Estonia

See https://www.id.ee/en/.

Tip Automated installation script in Estonian community wiki: EST | ENG. Although initially created for Manjaro Linux, it is also suitable for Arch Linux and other related distributions that use pacman.

### DigiDoc

Once ccid and opensc is installed and `pcscd.socket` is started, install qdigidoc4AUR. One of the dependency xml-security-cAUR is verified with a signature that you have to import to your GnuPG keyring.

    $ gpg --keyserver keys.openpgp.org --recv-keys DCAA15007BED9DE690CD9523378B845402277962

If you have an ACS card reader, acsccid is required.

DigiDoc4 has an optional GNOME/Files right click menu integration that requires nautilus-python to be installed.

### Browser Configuration

Current browser ID-Card stack is based on Web eID. It provides consistent user experience on all supported platforms for both PIN 1 authentication and PIN 2 document signing.

Web eID consists of two components. Both need to be installed.

- web-eid-nativeAUR - Native component used by all browsers
- web-eid-chromeAUR and web-eid-firefoxAUR - Browser extension that talks to the native component

web-eid-nativeAUR is verified with a signature and you need to import developer PGP keys to your GnuPG keyring.

    $ wget -q -O- https://github.com/metsma.gpg | gpg --import -
    $ wget -q -O- https://github.com/mrts.gpg | gpg --import -

Note `chrome-token-signing` package has been merged into Web eID and can be uninstalled.

Not all sites have migrated to the new Web eID PIN 1 JavaScript API and use the older Mutual TLS (also some times called TLS-CCA. You still need to configure opensc PKCS #11 provider in the browsers by running this command:

    $ pkcs11-register

You will also need to restart the browser afterwards.

Note Firefox package `esteidpkcs11loader` can be removed as it is now replaced with `pkcs11-register` command from opensc package

### Testing

- Make sure that Web eID extension is installed and enabled
- Go to https://web-eid.eu/ and follow Authenticate -> Sign flow
- Test Mutal TLS (TLS-CCA) using https://test-eid.eesti.ee/

## Finland

Atostek ID is the official client of the Finnish Digital and Population Data Services Agency. Atostek ID was released at the end of 2024. Atostek ID replaces the previous card reader software DigiSign Client. However, DigiSign Client still receives updates until the end of 2026. These updates will focus on bug fixes and security updates. No new features are planned for the old client.

Having both clients installed at the same time is not recommended.

Official information on the card reader software is available at: https://dvv.fi/en/download-card-reader-software.

### Atostek ID

Atostek ID is the current official card reader software.

#### Installation

Install atostekidAUR. Since Atostek ID is a GUI application that relies heavily on the system tray, pay attention that relevant optional dependencies are installed for your desktop environment.

Make sure to enable and start the `pcscd.socket`. Otherwise the client might not start, or applications that rely on the client might crash.

#### Activation

New government issued ID cards need to be activated before usage. This needs to be done only once.

Connect the card reader to your computer and insert your smart card. Launch the application. If the card has not been activated previously, the client will automatically display the activation window. Activation is required only once per card. If the activation window does not appear, choose "Activate card" from the application menu. When the activation window opens, enter the activation code (PUK) provided in the code letter that came with your card. Next, set a PIN for the authentication certificate (PIN1) and another PIN for the signing certificate (PIN2). It is highly recommended that PIN1 and PIN2 are different. Once you have entered the required information, click OK.

#### Usage

Atostek ID supports digital authentication and signing. It also utilizes the PKCS #11 interface. The card reader software can be used, for example, to authenticate with a web browser, to sign PDF documents, and logging in to the system. See the official instructions at: https://dvv.fi/en/download-card-reader-software

Version 4.4.1.0 introduced a helper script `atostekid-setup-user-browser.sh` that configures Firefox and Chromium based browsers, and installs Atostek ID related certificates. When the application is started for the first time, a dialog window shows up and asks if the user wants to run basic setup. Behind the scene, it runs this setup script.

##### Firefox

Under Settings, navigate to Privacy and Security > Connection and software security > Advanced Settings > Certificates > Manage security devices. Alternatively, search for `security devices` in Settings to find the correct section. When you have the Device Manager dialog open, click Load and set Module Name to `p11-kit-proxy` and module filename to `p11-kit-proxy.so`. Finally, restart Firefox. The card can be tested at: https://dvv.fi/en/test-the-use-of-a-certificate.

Tip If you only intend to use the ID card for authenticating to suomi.fi services, setting up the PKCS #11 module is all you need to do.

##### Signature Creation Service (SCS)

Signature Creation Service (SCS) is a specification of the Digital and Population Data Services Agency. It is used, for example, in patient information systems. SCS utilizes self-signed certificates, which can be generated by running:

    $ atostekid -installSCSCA

This will create a certificate (`scsca.cer`) and a private key (`scsca.p12`) in `$HOME/.local/share/Atostek Oy/Atostek ID/`. The certificate will need to be installed manually to your web browser.

##### Atostek ERA Smartcard

Atostek ERA Smartcard is a feature intended for social and healthcare users who are registered to use the ERA system. It utilizes self-signed certificates, which can be generated by running:

    $ atostekid -installCA

This will create a certificate (`erasmartcard_ehoito_fi_ca.cer`) and a private key (`erasmartcard_ehoito_fi_cert.p12`) in `$HOME/.local/share/Atostek Oy/Atostek ID/`. The certificate will need to be installed manually to your web browser.

#### Known issues

##### PIN code dialogs

When authenticating and signing with Firefox, the PIN dialogs are not delegated to the Atostek ID client. Instead, the native PIN dialogs of Firefox are shown. It is possible that Firefox will ask for a PIN multiple times.

This is documented in the Atostek ID 4.5 User Guide for Linux v1.0:

  "Note! When using mTLS authentication for the first time, your browser may prompt for the PIN code multiple times. This is normal behaviour due to how browsers handle certificates. Please enter your PIN for each prompt."

##### Crash on Wayland

Since version 4.4.1.0, Atostek ID crashes if the QT Wayland backend is used. This can be mitigated by using the QT X11 backend. The desktop file provided in the AUR package already applies this mitigation. However, when starting the application from the command line, the backend needs to be set explicitly:

    $ QT_QPA_PLATFORM="xcb" atostekid

##### Crash due to old configuration files

Occasionally after updating, old user settings and certificates might also crash the application. If you are unable to start the application, try to start from scratch by removing the directory `$HOME/.local/share/Atostek Oy/Atostek ID/`.

### DigiSign Client

DigiSign Client is the old card reader software. It will be supported until the end of 2026. The Finnish Digital and Population Data Services Agency recommends using the new #Atostek ID client instead.

#### Installation

First install the prerequisites as described in #Installation. Then install vrk-mpollux-digisign-clientAUR. Launch the client, connect your reader and put in your card. Click the icon in your status bar once it turns yellow. This should trigger the card activation process if you have not activated it before.

#### Usage

##### Firefox

Navigate to the Security Devices page (Search it via Preferences), then click Load and set Module Name to DigiSign PKCS#11-moduuli and module filename to `/usr/lib/libcryptoki.so`. Finally restart Firefox. The card can be tested at: https://dvv.fi/en/test-the-use-of-a-certificate.

## Germany

### ReinerSCT devices

For some devices, you need to install pcsc-cyberjack and copy the default configuration file `/etc/pcsc-cyberjack/cyberjack.conf.default` to the same folder, without the .default suffix. Restart `pcscd.service` and applications like ausweisapp should recognize the scanner. The ReinerSCT RFID will blink its LED, which it does not when the driver is not installed correctly.

You can also use a smartphone as the card reader, if both your computer and the smartphone are in the same network. You must install and run AusweisApp on the phone (available for Android / iPhone).

## Latvia

### eParaksts

For document signing install the eparakstitajs3AUR package. No additional software is necessary to use it with eParaksts mobile or eID Scan.

To use the eID card, install latvia-eid-middlewareAUR and the prerequisite packages listed in #Installation, and make sure to enable and start `pcscd.service`. To use it in a browser, additionally install the browser extension eparaksts-token-signingAUR.

To use the eID card via NFC, additionally install libnfc. Make sure `/opt/latvia-eid/etc/xdg/autostart/org.latviaeid.eidlvuiserver.desktop`, which provides a dialog to input the eID card's access number, is started with the graphical session. E.g.:

    $ ln -s /opt/latvia-eid/etc/xdg/autostart/org.latviaeid.eidlvuiserver.desktop ~/.config/autostart/

Launch the .desktop file manually or re-login to make sure eidLvUIServer is running.

Tip The card access number (CAN) is a six digit number found on the front of the card, in the lower right corner.

### Smart-ID

To use the eID card with Smart-ID, install the following packages:

- web-eid-nativeAUR - Native component communicating with all browsers
- web-eid-chromeAUR or web-eid-firefoxAUR - Browser extensions that communicate with the native component

## Romania

1. Start/enable `pcscd.service`
2. Install idplugclassic-ro-cei-binAUR.
3. Launch the client from `/usr/bin/idplugclassic/identitymanager`

Refer to the Romanian eID wiki page for further installation tips and troubleshooting.

### Firefox

Navigate to Edit > Preference > Advanced > Certificates > Security Devices and click Load to load a module using `/usr/lib/idplugclassic/libidplug-pkcs11.so`. You can assign any name to it, i.e. `RO CEI PKCS#11 Module`.

### Issues with performance

Refer to the Romanian eID wiki page.

## Spain

### DNI electrónico (DNIe)

Install ca-certificates-dnieAUR. To sign documents using your identity card, install the autofirma package (autofirmaAUR).

## Sweden

BankID is the leading electronic identification in Sweden.

Categories:

- Smartcards
- Authentication

Hidden category:

- Pages or sections flagged with Template:Style

Electronic identification
Add topic