My system is to the point where command line interaction with the smart card behaves as expected, as long as I use the OpenSC middleware to pam_pkcs11, and not coolkey. Using pklogin_finder asks for the PIN, verifies the certificates, and maps the user to a local system account. System details in previous thread: https://www.redhat.com/archives/pki-users/2015-April/msg00041.html

My expectation was that the “smart card manager” should pop up when the card is inserted. It doesn’t. I can type “esc” at the command line, and it says “No Cards Present” with everything greyed out. Likewise, inserting the smart card at the login prompt does nothing. There _is_ an “./escd” process running. Is ESC hardwired to use coolkey, which can’t read my card? How can I debug this?

Final question: Am I correct to assume that my situation does not call for a TPS, TKS, or even a CA? I must not touch the info on these smart cards: Never format, never issue certs, never save, never change. My machines just need to respect a totally external PKI infrastructure: ask for PIN, verify cert against the CA bundle, and start a login session. For any of the things I would need a PKI infrastructure for, I need to make an appointment at a GSA Credentialing Center, then physically show up with two forms of ID in hand.

Many thanks for your helpful advice!

Bryce