Client Certificate Authentication via URLCredential on WKWebView and PIV app on Yubikey

[luky88]

Hi @jensutbult, is there any possibility to receive an answer to this question?

Can you please tell me how did you construct URLCredential for the WKWebView through PIV card on iOS?

Reading the docs and using the SDK it seems to be possible to obtain only a SecCertificate from a PIV session, but to use a TLS client authentication within a WKWebView a SecIdentity is needed.

An help will be really appreciated!
Thanks in advance

Originally posted by @luky88 in #5

[jdmoreira]

@luky88 Sorry for the late reply.

This is not something that can be done with the SDK alone. This needs to be done through a CryptoTokenKit extension.

[luky88]

ciao @jdmoreira, thanks for the reply!

After posting my first comment I've found this article on your site explaining the need of using a CryptoTokenKit extension: https://www.yubico.com/blog/how-to-implement-a-cryptotokenkit-extension-on-ios/

So we followed the article and in particular we included in our project the code we found here in your example: https://github.com/YubicoLabs/yubico-ctk-samples-ios

In our project we are trying to use a WKWebView to complete a mTLS authentication using as client certificate the one stored on Yubikey, and following the example in the above repo, together with the Yubico Authenticator app installed on the same device, we are now able to initiate the client certificate authentication using the SecIdentity stored on the Yubikey.

However, after unlocking the Yubikey with the PIN (in the Yubico Authenticator app) and after having successfully received the SecIdentity in the code and of course provide it to the WKWebView, our backend does not receive the client certificate attached to the HTTP response.

Then we've tried the same procedure using directly an URLSession task to invoke the backend, and also in this case, even if the SecIdentity is successfully provided to the URLSession, our backend does not get it in the HTTP response.

Could you please let us know if there is a know issue somewhere in this kind of flow and/or if you can provide us with some working example on how to successfully complete a client certificate authentication using the CryptoTokenKit extension?

If needed, you can reach me directly on my working email and I can provide you with some more detailed examples.

thanks in advance

[jdmoreira]

@luky88 again sorry for the late reply.

I've just tested and verified with Safari and yubico-ctk-samples-ios against https://client.badssl.com/ and everything worked.
I would ask you to try and verify against https://client.badssl.com/ as well.

Roughly these are the steps (watch https://www.youtube.com/watch?v=eDhWuDJGYVA before):

• From https://badssl.com/download/ get the pem file. Use a computer to import the certificates into your YubiKey. Either with the authenticator app or with yubico-piv-tool -a verify-pin -s 9a -a import-key -a import-cert -i badssl.com-client.pem

• On your iOS authenticator app setup the smart card extension. It should look like this:
  

• Now you can try with Safari first to navigate to https://client.badssl.com/

• Once you have verified that it works with Safari (it can be a bit flakey) then you can try to build https://github.com/YubicoLabs/yubico-ctk-samples-ios to you iOS device and verify that it works with this sample project as well.

• Once you've verified yubico-ctk-samples-ios try to verify your own code against https://client.badssl.com/. You can compare and debug your own implementation against yubico-ctk-samples-ios until it works the same.