HID ActivClient CryptoTokenKit
HID ActivClient CryptoTokenKit (CTK) is a middleware solution providing access to the Public Key Infrastructure PKI. A framework that enables secure, electronic identities through the use of public key cryptography, including the creation, distribution, and management of digital certificates. (PKI) functionalities of smart cards and security keys on macOS. It extends the standard Apple CryptoTokenKit functionality by adding support for smart cards and keys supported by ActivClient, including non-PIV Personal Identity Verification is a United States federal standard for secure and reliable forms of identification issued by the government to federal employees and contractors. See https://csrc.nist.gov/projects/piv/piv-standards-and-supporting-documentation for more information. (General-Purpose) slots support.
ActivClient CTK is installed as part of the ActivClient setup.
How It Works
When you insert a supported smart card or key, ActivClient CTK exposes its cryptographic content, making it available for use alongside items stored in the Keychain. When a service (such as VPN, email signing, or Safari authentication) requests authentication, the system displays a list of available credentials, allowing you to select the certificate or key to use.
Advanced Smart Card Options
ActivClient CTK also enables you to interact with smart cards and keys via the command line. The following sections list the most commonly used commands for working with smart card capabilities:
Signing In Using a Token
For a more detailed description of the commands listed below, see Signing In Using a Token.
To manually pair a smart card with a macOS user account:
sudo sc_auth pair -h <HASH> -u <USER>
To retrieve the hash value of a certificate stored on a token:
sc_auth identities
To confirm that the token is paired with the user:
sc_auth list
To unpair a specific certificate from macOS login:
sudo sc_auth unpair -h <HASH>
To remove all pairing for a single user:
sudo sc_auth unpair -u <USER>
To disable the UI for token pairing:
sc_auth pairing_ui -s disable
To re-enable the UI for token pairing:
sc_auth pairing_ui -s enable
Viewing Card and Certificate Information
For a more detailed description of the commands listed below, see Viewing Card and Certificate Information.
To view available tokens:
sudo security list-smartcards
To view available certificates:
system_profiler SPSmartCardsDataType
Managing Smart Card Token Modules
For a more detailed description of the commands listed below, see Managing Smart Card Token Modules.
To check which smart card token modules are installed:
pluginkit -m -p com.apple.ctk-tokens
To disable a specific smart card token module:
sudo security smartcards token -d <token>
To enable a specific smart card token module:
sudo security smartcards token -e <token>
To check which smart card token modules are disabled:
sudo security smartcards token -l