Using an A3 digital certificate in a remote VM

[rotgerus]

Hello everyone, I’ve been using Zorin OS for a short time and so far it has met all my needs. However, there is one specific setup that I used to do on Windows that I haven’t been able to get working on Zorin.

I used an A3 token-based digital certificate connected to my PC and accessed it inside a remote VM. On Windows this works automatically. On Zorin, I installed all the dependencies I could find (including from a topic here in the community), and when I access the VM via Remmina, the certificate authentication screen does appear, as if the token was recognized. However, after entering the PIN/password, the process freezes and I have to forcefully terminate it.

Would anyone be able to help me with this?

[swarfendor437]

Hi and Welcome.

I know nothing about this, so I used Ubuntu 24.04 in my Brave A.I. search parameters as that is what Zorin 18 is based on and it came back with the following:

" A3 digital certificate is a type of digital identity stored on a physical hardware token—typically a USB device resembling a small pendrive. It contains a private key and digital certificate used for secure authentication, digital signatures, and encryption. Unlike A1 certificates (stored as files), A3 tokens require specific drivers and software to access their private key, ensuring higher security. Common brands include SafeNet Etoken, Watchkey, and GD Starsign.

To access an A3 digital certificate from a remote VM on Ubuntu 24.04 , follow these steps:

• Ensure the VM supports USB passthrough : Configure your virtualization platform (e.g., VirtualBox, KVM/QEMU) to pass the A3 token through to the VM. For KVM, use virsh edit <vm-name> and add a USB host device passthrough.
• Install required packages in the VM :

sudo apt update
sudo apt install -y pcscd opensc libnss3-tools libssl3

• Install the vendor-specific driver (e.g., SafeNet for Etoken):
  • Download the Linux installer from the vendor (e.g., GlobalSign SafeNet Drivers).
  • Extract and install via dpkg :

wget https://www.globalsign.com/en/safenet-drivers/USB/10.7/Safenet_Linux_Installer_DEB_x64.zip
unzip Safenet_Linux_Installer_DEB_x64.zip
sudo dpkg -i safenetauthenticationclient_10.7.77_amd64.deb

• Enable PC/SC daemon :

sudo systemctl enable pcscd
sudo systemctl start pcscd

• Configure browsers :
  • Firefox : Go to Settings > Privacy & Security > Certificates > Security Devices > Load and point to /usr/lib/libeToken.so .
  • Chrome/Edge : Install via .deb (not Snap/Flatpak) and ensure the token is recognized in the browser’s certificate manager.

Note : The A3 token must be physically connected to the host machine, and USB passthrough must be enabled in the VM. Some tokens may require additional firmware or configuration for remote access.

AI-generated answer. Please verify critical facts."

Just to add that virt-manager is better than Virtual Box because:

A. It supports USB 3.0 ports better, and

B. If you forget to add the USB as part of the VM machine details you can do a USB redirect while running the VM.