search

NoMoreFood / putty-cac

Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys
482 stars 43 forks source link

putty-cac not seeing all certificates on PIV/CAC #119

Closed DrDeke closed 11 months ago

DrDeke commented 11 months ago

Greetings,

I am trying to use putty-cac to authenticate to some ssh servers using the certs/keys stored on my PIV/CAC, but putty-cac doesn't seem to "see" the correct certificate on my card when I try to select it using either the PKCS (via ActivClient's acpkcs211.dll) or CAPI interfaces.

My card has multiple certificates on it. The one corresponding to the public key on the servers I am trying to connect to is labeled "Signature" in ActivClient, but the only certificate that shows up in putty-cac is the certificate labeled "Authentication".

Certificate list in ActivClient:

activclient-certlist

.

Certificate selection window in putty-cac:

puttycac-capi-certlist

.

The Tectia SSH client can see both sets of certs/keys and works fine if I select the one corresponding to the public key on the servers, but I strongly prefer to use putty as a client:

tectia-keylist

.

Any idea what I might be doing wrong? Or could putty-cac be calling a different API than Tectia, one that doesn't present all certificates on a card or something like that? I cannot change which public key is accepted by the servers I'm trying to connect to, so it'd be really cool if I could get putty-cac to use the needed cert/private-key.

NoMoreFood commented 11 months ago

Try running putty.exe -allowanycert and see if it shows up.

DrDeke commented 11 months ago

That did the trick, thanks!