Cannot use HDI Omnikey 3121 USB with MacOS Catalina

I tried to install new drivers from HDI's support&drivers page. But none of them worked.

Did someone manage to make this combination work:

• MacOS Catalina
• HDI Omnikey 3212 (USB)

I tried to install/installed the following drivers:

• HID® OMNIKEY® 5x2x, xx21 PCSC Driver for Mac OS X (2018)
• HID® OMNIKEY® 5x2x, xx21 PCSC for Mac OS X (2016)
• HID® OMNIKEY® 3x21 PC/SC CCID driver for Mac OS X (2013)
• HID® OMNIKEY® 3x21 PC/SC CCID driver for Mac OS X on Intel (2012)

All drivers older than 2016 couldn't be installed at all. The newer ones installed, but connecting the device to my Macbook and inserting the PKI Card didn't bring up any certificates in the Keychain tool and couldn't use Safari for logins using PKI nor sign/decrypt mails.

1 Answer

This could be solved with the help of the very responsive support of HID. I raised a support ticket with them and now it works. Here are the steps to solve this and use PKI cards on MacOS Catalina with Firefox.

This is my Macbook configuration:

• MacBook Pro (15-inch, 2017)
• MacOS: 10.15.3
• Processor: 2,9 GHz Quad-Core Intel Core i7
• Memory: 16 GB 2133 MHz LPDDR3

Install drivers

I installed the following driver:

Test the connected card reader device

I used the command line to verify the device is detected:

pcsctest

Enter 1 when asked for the device (this might differ from system to system) and finally I got the output:

~ pcsctest
MUSCLE PC/SC Lite Test Program
Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: HID Global OMNIKEY 3x21 Smart Card Reader
Enter the reader number : 1
Waiting for card insertion : Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : HID Global OMNIKEY 3x21 Smart Card Reader
Current Reader State : 0x54
Current Reader Protocol : 0x1
Current Reader ATR Size : 12 (0xc)
Current Reader ATR Value : 3B D2 18 02 C1 0A 31 FE 58 C8 0D 51
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.
Testing SCardEstablishContext : Command successful.
Testing SCardGetStatusChange
Please insert a working reader : Command successful.
Testing SCardListReaders : Command successful.
Reader 01: HID Global OMNIKEY 3x21 Smart Card Reader
Enter the reader number : 1
Waiting for card insertion : Command successful.
Testing SCardConnect : Command successful.
Testing SCardStatus : Command successful.
Current Reader Name : HID Global OMNIKEY 3x21 Smart Card Reader
Current Reader State : 0x54
Current Reader Protocol : 0x1
Current Reader ATR Size : 12 (0xc)
Current Reader ATR Value : 3B D2 18 02 C1 0A 31 FE 58 C8 0D 51
Testing SCardDisconnect : Command successful.
Testing SCardReleaseContext : Command successful.
PC/SC Test Completed Successfully !

Configure Firefox

1. Go to Settings > Data privacy and security > Certificates.
2. Click the button labeled "Cryptograhic module" (or "Add device" - depends on the Firefox version in use)
3. Click on "New PKCS#11 module" in the list of modules
4. Click on button labeled "Load"
5. Click on button labeled "Search"
6. Search for the driver: /Library/OpenSC/lib/opensc-pkcs11.so

To be honest: I'm not sure if I installed the OpenSC drivers myself or sometime in the past. Nevertheless you can find them here: . Just install the MacOS package

Once done the device shows up in the list of PKCS#11 modules and shows the certficates provided on the inserted PKI card.

Optional: Install custom root certificates

Depending on your security and authentication setup you need to install some custom root certificates. I need to do that using the Certificate Management in Firefox.

Open a secured page to test your login with PKI card

I had to use a new private window in Firefox to force a new login flow (in Firefox): File > New private window > Enter the URL

Remark

I checked the chipset of the usb card reader device. According to support this is the list and corresponding drivers. This is the response from support:

It maybe that you are using one the newer OMNIKEY 3x21 readers - you can confirm the Revision underneath.

R3x210020 x-chip

R3x210120 x-chip

R3x210220 x-chip

R3x210320 Aviator

The Rev B (R3x210320-03) is a reader with the Aviator chipset and the readers with the Aviator chipset do not require additional drivers as they utilise native USB CCID drivers within the OS (Windows, MacOS & Linux).

For MacOS: PCSC driver for Aviator, if required:

Or for X-Chip firmware readers: