Basic Information
The Taglio PIV Card Tool is a command line tool that works with Taglio PIV Cards such as the C2190 and C2192, as well as other PIV compatible devices. It manages the keys, pin, puk, and allows for the creation of certificates and csr files.
It can be download here: https://www.taglio.com/download/taglio-piv-tool-installer.zip
NOTE: The Taglio PIV Tool executable is installed into the application folder.
Usage:
taglio-piv-tool command [ command_opts ] [ command_args ]
Commands:
list-cert [-key-ref ref] [-output filename] [-reader readername]
list-certs [-reader readername]
list-cardid [-reader readername]
list-config [-reader readername]
list-readers
test-pin [-pin pin] [-reader readername] [-config configfilename]
test-admin [-admin adminkey] [-reader readername] [-config configfilename]
test-key [-key-ref ref] [-pin pin] [-reader readername] [-config configfilename]
change-pin [-pin pin] [-new-pin newpin] [-reader readername] [-config configfilename]
change-puk [-puk puk] [-new-puk newpuk] [-reader readername] [-config configfilename]
change-admin [-admin adminkey] [-new-admin newadminkey] [-reader readername] [-config configfilename]
unblock-pin [-puk puk] [-new-pin newpin] [-reader readername] [-config configfilename]
generate-key [-key-ref ref] [-key-alg alg] [-admin adminkey] [-pin pin] [-reader readername] [-config configfilename]
generate-cert [-key-ref ref] [-subject subject] [-admin adminkey] [-pin pin] [-reader readername] [-config configfilename]
generate-csr [-key-ref ref] [-subject subject] [-pin pin] [-output filename] [-reader readername] [-config configfilename]
generate-csr-onbehalfof [-key-ref ref] [-name Domain\User] [-cert enrollmentagentthumbnail] [-pin pin] [-output filename] [-reader readername] [-config configfilename]
load-cert [-key-ref ref] [-admin adminkey] [-input filename][-no-compression][-reader readername] [-config configfilename]
load-pfx [-key-ref ref] [-admin adminkey] [-input filename] [-input-password password] [-reader readername] [-config configfilename]
help
Notes:
If options are required, but not specified then application will prompt for them.
pin is always entered as ascii string (i.e -pin 77777777).
puk and admin are always entered as hex string (i.e -puk 3030303030303030).
If a config file is specified, then the application will check the config file for protected arguments such as keys, pins, puks, and passwords before prompting for them.
To use a specific reader use the -reader option. If -reader option not specified, then first reader found will be used.
To see a list of available readers use "list-readers".
Understanding how the taglio-piv-tool works
If required arguments are not specified in the command line, then the user will be prompted to enter them.
If the -config configfilename argument is specified then the admin key and pin will be read from the config file. The file config.txt is included in the install directory and contains the default pin and admin key.
The generate-key option will generate a new key pair in the specified slot. It will also generate a self signed certificate that is stored on the card. The certificate contains the public key for the generated key pair. This allows the public key to be read in future calls.
Self-Enrollment Using a Microsoft CA
A common use case is to use the tool to add certificates to the card.
This can be accomplished with the following steps:
Step 1: Generate keys
.\taglio-piv-tool.exe generate-key -key-ref 9A -key-alg 07 -config config.txt
Step2: Generate csr
.\taglio-piv-tool.exe generate-csr -key-ref 9A -subject “Test 9A” -output user.req -config config.txt
Step3: Submit the csr to Microsoft using the Microsoft certreq tool. This can be done with the following command. Note if -config CAHostName\CAName is left out, then MS will prompt for the CA to use. You will specify your smartcard logon template name in place of templatename.
certreq -submit -attrib "CertificateTemplate:templatename" -config CAHostName\CAName user.req user.cer
Step4: Load the resulting cert onto the card
.\taglio-piv-tool.exe load-cert -key-ref 9A -input user.cer -config config.txt
Enrolling on Behalf of Using Microsoft CA
If using a Microsoft CA and generating a csr on behalf of someone else, then the generate-csr-onbehalfof option can be used. That would work as follows:
Step 1: Generate keys
.\taglio-piv-tool.exe generate-key -key-ref 9A -key-alg 07 -config config.txt
Step 2. Generate csr using the generate-csr-onbehalfof command. This will put the Domain\user into the csr for the Microsoft CA to use later. The CSR will be signed by the enrollment agent certificate specified by the thumbnail after the -cert option. Replace the thumbnail in the example below with the thumbnail for your enrollment agent.
.\taglio-piv-tool.exe generate-csr-onbehalfof -key-ref 9A -name Domain\user -cert 557698ce1d3d948c1aa357d7d7f3e5a6a793d701 -output user.req -config config.txt
3. Submit the csr to Microsoft using the Microsoft certreq tool. This can be done with the following command. Note if -config CAHostName\CAName is left out, then MS will prompt for the CA to use. You will specify your smartcard logon template name in place of templatename.
certreq -submit -attrib "CertificateTemplate:templatename" -config CAHostName\CAName user.req user.cer
4. Load the cert to the card.
.\taglio-piv-tool.exe load-cert -key-ref 9A -input user.cer -config config.txt
Troubleshooting:
Trouble reading certificates in the 9A, 9C, 9D slots.
The PIV spec limits reading these certificates over the contactless interface. Try using a contact reader.
Note: Specially configured cards may be purchased that allow full functionality over the contactless interface. However, this is not conformant with the spec. If interested in this configuration contact sales@taglio.com
Trouble writing to the card
The PIV spec limits functionality over the contactless interface. Try using a contact reader.
Note: Specially configured cards may be purchased that allow full functionality over the contactless interface. However, this is not conformant with the spec. If interested in this configuration contact sales@taglio.com
Trouble loading a pfx to the 9A, 9C slots.
The PIV spec limits loading keys to theses slots. Try using the workflow that generates keys on the cards.
Note: Specially configured cards may be purchased that allow loading keys to these slots. However, this is not conformant with the spec. If interested in this configuration contact sales@taglio.com
Unable to write csr or cert to file
By default tool is installed in the Program Files directory which has limited write permissions. Try writing to a different location. For example, make sure the folder c:\temp exists (or create if it doesn’t) and then run the following command
C:\Program Files\Taglio PIV Tool>.\taglio-piv-tool.exe generate-csr -output C:\temp\test.csr
Comments
0 comments
Please sign in to leave a comment.