Electronic identification

Related articles
Common Access Card
Smartcards
This article or section needs language, wiki syntax or style improvements. See
Help:Style
for reference.
Reason:
Some duplication with
Smartcards
(Discuss in
Talk:Electronic identification
)
An
electronic identification
("eID") is an electronic identification solution of citizens or organizations, for example in view to access benefits or services provided by government authorities, banks or other companies. Apart from online authentication many eICs also give users the option to sign electronic documents with a digital signature.
Installation
Install
the
ccid
package, all electronic identification requires this package. Then see
#Hardware specific packages
.
For pinentry support,
install
pinentry
.
Hardware specific packages
ACS smart cards
Install
the
acsccid
package.
For more information about ACS smart cards, see
[1]
.
Cr-75 card reader
Install
the
libcr75-git
AUR
package for the device with the
1307:0361
ID.
Belgium
Installing the eID middleware
Import the (continuous build) keys from
[2]
. See
makepkg#Signature checking
. Install the
eid-mw
AUR
package, then run:
$ about-eid-mw
In the window that opens, the PCSC daemon status should be listed as "running". If it is not the case,
start
pcscd.service
. Even if the service reports that it's socket activated or automatically started instead of "running", the service may need to be started manually.
Installing the card reader's driver
Look at the brand of the card reader; there is a high chance it is ACS (Advanced Card System Ltd).
If it is ACS, go to
https://belgeid.be/en/product/acr38
and download the Linux driver.
Follow the described install driver process.
Installing the browser integration
Chrome/Chromium
Chrome does not need a plugin. Chromium require
opensc
and
p11-kit
as well.
This article
provides some instructions.
Firefox/Librewolf
A
browser extension
will need to be installed. 
Additionally, the eID module will need to manually be added to the Firefox security devices configuration. The steps are:
Open Firefox' settings.
Search for 'security devices'. Click the corresponding button.
In the popup, select 'Load'.
The second popup will ask for a file location. You can find this file by running
about-eid-mw
and looking for the "64-bit PKCS#11 location" value.
For Librewolf, also symlink the directories created by the middleware to
/usr/lib/librewolf/
, to avoid an error notification when starting Librewolf:
# ln -s /usr/lib/mozilla/managed-storage /usr/lib/librewolf/managed-storage
# ln -s /usr/lib/mozilla/pkcs11-modules /usr/lib/librewolf/pkcs11-modules
General troubleshooting
A test page
is available from the government to check if eID is configured correctly. Troubleshooting hints may be available in the
official documentation
, although Arch Linux is not officially supported.
Also note that using
Flatpak or Snap is/was not supported
, as those do not allow PKCS#11 modules such as eID to be loaded. Fixed for snap for all opensc readers:
closed launchpad bug
.
Signing documents
Signing emails with Thunderbird and documents with LibreOffice is explained in
a blog post
by Luc Stroobant.
Depending on system configuration, it may be possible to run
Adobe Reader DC under wine
. The Belgium government has a
relevant FAQ item on digital signatures
.
If using Adobe Reader is not possible, the Belgian Federal Public Services'
Signing Box
offers an upload tool to sign PDFs. The website prompts to install two dependencies: an extra eID middleware
beidconnect
AUR
and a browser extension.
Although
okular
and
papers
provide native support for digital PDF signing, signatures are not reported as valid by Signing Box. An
open bug ticket
exists for okular.
Brazil (ICP-Brasil)
SSL
Install
ca-certificates-icp_br
AUR
as the Brazilian root CAs are not part of Mozilla's NSS due to a
long standing issue
.
The above package should be enough. If you have any issue, check [ITI's installation instructions
https://www.gov.br/iti/pt-br/assuntos/navegadores
] for Chromium, Firefox and other popular web browsers, and for Java.
Smart Cards (A3 certificates)
1. Install
safesignidentityclient
AUR
and
opensc
.
2.
Start/enable
pcscd.service
Note
Having the
"CAC Module"
(
/usr/lib/opensc-pkcs11.so
) enabled can cause problems both in Firefox and Chrome
Firefox
Navigate to
Edit -> Preference -> Advanced -> Certificates -> Security Devices
and click "Load" to load a module using
/usr/lib/libaetpkss.so
and name it
ICP-Brasil A3 - Safe Sign Identity Client
.
Note
Firefox may report the module did not load correctly however you will have to check in the security devices to confirm whether the module properly loaded or not
Test it by going to
Receita Federal's e-CAC
.
Chrome
Ensure Chrome is closed and run:
$ modutil -dbdir sql:$HOME/.pki/nssdb/ -add "ICP-Brasil A3 - Safe Sign Identity Client" -libfile /usr/lib/libaetpkss.so
Croatia
Start/enable
pcscd.service
Install
certiliamiddleware
AUR
.
Launch the client. It is used for activating the card or changing the PINs or the PUK.
Firefox
Navigate to
Edit > Preference > Advanced > Certificates > Security Devices
and click
Load
to load a module using
/usr/lib/akd/certiliamiddleware/pkcs11/libEidPkcs11.so
. You can assign any name to it, i.e.
Cro PKCS#11 Module
.
Estonia
See
https://www.id.ee/en/
.
Tip
Automated installation script in Estonian community wiki:
EST
|
ENG
. Although initially created for Manjaro Linux, it is also suitable for Arch Linux and other related distributions that use
pacman
.
DigiDoc
Once
ccid
and
opensc
is installed and
pcscd.socket
is
started
, install
qdigidoc4
AUR
. One of the dependency
xml-security-c
AUR
is
verified with a signature
that you have to
import
to your GnuPG keyring.
$ gpg --keyserver keys.openpgp.org --recv-keys DCAA15007BED9DE690CD9523378B845402277962
If you have an ACS card reader,
acsccid
is required.
DigiDoc4 has an optional
GNOME/Files
right click menu
integration
that requires
nautilus-python
to be installed.
Browser Configuration
Current browser ID-Card stack is based on
Web eID
.
It provides consistent user experience on all supported platforms for both PIN 1 authentication and PIN 2 document signing.
Web eID consists of two components. Both need to be installed.
web-eid-native
AUR
- Native component used by all browsers
web-eid-chrome
AUR
and
web-eid-firefox
AUR
- Browser extension that talks to the native component
web-eid-native
AUR
is
verified with a signature
and you need to
import
developer PGP keys to your GnuPG keyring.
$ wget -q -O-
https://github.com/metsma.gpg
| gpg --import -
$ wget -q -O-
https://github.com/mrts.gpg
| gpg --import -
Note
chrome-token-signing
package has been merged into Web eID and can be uninstalled.
Not all sites have migrated to the new Web eID PIN 1 JavaScript API and use the older
Mutual TLS
(also some times called
TLS-CCA
. You still need to configure
opensc
PKCS #11 provider in the browsers by running this command:
$ pkcs11-register
You will also need to restart the browser afterwards.
Note
Firefox
package
esteidpkcs11loader
can be removed as it is now replaced with
pkcs11-register
command from
opensc
package
Testing
Make sure that Web eID extension is installed and enabled
Go to
https://web-eid.eu/
and follow Authenticate -> Sign flow
Test Mutal TLS (TLS-CCA) using
https://test-eid.eesti.ee/
Finland
Atostek ID is the official client of the Finnish Digital and Population Data Services Agency. Atostek ID was released at the end of 2024. Atostek ID replaces the previous card reader software DigiSign Client. However, DigiSign Client still receives updates until the end of 2025. These updates will focus on bug fixes and security updates. No new features are planned for the old client.
Having both clients installed at the same time is not recommended.
Official information on the card reader software is available at:
https://dvv.fi/en/download-card-reader-software
.
Atostek ID
Atostek ID is the current official card reader software.
Installation
Install
atostekid
AUR
. Since Atostek ID is a GUI application that relies heavily on the system tray, pay attention that relevant optional dependencies are installed for your desktop environment.
Make sure to
enable
and
start
the
pcscd.socket
. Otherwise the client might not start, or applications that rely on the client might crash.
Activation
New government issued ID cards need to be activated before usage. This needs to be done only once.
Connect the card reader to your computer and insert your smart card. Launch the application. If the card has not been activated previously, the client will automatically display the activation window. Activation is required only once per card. If the activation window does not appear, choose "Activate card" from the application menu. When the activation window opens, enter the activation code (PUK) provided in the code letter that came with your card. Next, set a PIN for the authentication certificate (PIN1) and another PIN for the signing certificate (PIN2). It is highly recommended that PIN1 and PIN2 are different. Once you have entered the required information, click OK.
Usage
Atostek ID supports digital authentication and signing. It also utilizes the PKCS #11 interface. The card reader software can be used, for example, to authenticate with a web browser, to sign PDF documents, and logging in to the system. See the official instructions at:
https://dvv.fi/en/download-card-reader-software
Firefox
Navigate to
Security Devices
page (Search it via Preferences), then click
Load
and set Module Name to
p11-kit-proxy
and module filename to
p11-kit-proxy.so
. Finally restart Firefox. The card can be tested at:
https://dvv.fi/en/test-the-use-of-a-certificate
.
Signature Creation Service (SCS)
Signature Creation Service (SCS) is a specification of the Digital and Population
Data Services Agency. It is used, for example, in patient information systems. SCS utilizes self-signed certificates, which can be generated by running:
$ atostekid -installSCSCA
This will create a certificate (
scsca.cer
) and a private key (
scsca.p12
) in
$HOME/.local/share/Atostek Oy/Atostek ID/
. The certificate will need to be installed manually to your
web browser
.
Atostek ERA Smartcard
Atostek ERA Smartcard is a feature intended for social and healthcare users who are registered to use the ERA system. It utilizes self-signed certificates, which can be generated by running:
$ atostekid -installCA
This will create a certificate (
erasmartcard_ehoito_fi_ca.cer
) and a private key (
erasmartcard_ehoito_fi_cert.p12
) in
$HOME/.local/share/Atostek Oy/Atostek ID/
. The certificate will need to be installed manually to your
web browser
.
Known issues
When authenticating and signing with Firefox, the PIN dialogs are not delegated to the Atostek ID client. Instead, the native PIN dialogs of Firefox are shown. It is possible that Firefox will ask PINs multiple times.
DigiSign Client
DigiSign Client is the old card reader software. It will be supported until the end of 2025. The Finnish Digital and Population Data Services Agency recommends using the new
#Atostek ID
client instead.
Installation
First install the prerequisites as described in
#Installation
. Then install
vrk-mpollux-digisign-client
AUR
. Launch the client, connect your reader and put in your card. Click the icon in your status bar once it turns yellow. This should trigger the card activation process if you have not activated it before.
Usage
Firefox
Navigate to
Security Devices
page (Search it via Preferences), then click
Load
and set Module Name to
DigiSign PKCS#11-moduuli
and module filename to
/usr/lib/libcryptoki.so
. Finally restart Firefox. The card can be tested at:
https://dvv.fi/en/test-the-use-of-a-certificate
.
Germany
ReinerSCT devices
For some devices, you need to install
pcsc-cyberjack
AUR
and copy the default configuration file
/etc/pcsc-cyberjack/cyberjack.conf.default
to the same folder, without the
.default
suffix.
Restart
pcsc.service
and applications like
ausweisapp
AUR
should recognize the scanner. The ReinerSCT RFID will blink its LED, which it does not when the driver is not installed correctly.
You can also use a smartphone as the card reader, if both your computer and the smartphone are in the same network. You must install and run AusweisApp on the phone (available for
Android
/
iPhone
).
Latvia
eParaksts
For document signing install the
eparakstitajs3
AUR
package. No additional software is necessary to use it with eParaksts mobile or eID Scan.
To use the eID card, install
latvia-eid-middleware
AUR
and the prerequisite packages listed in
#Installation
, and make sure to
enable
and
start
pcscd.service
. To use it in a browser, additionally install the browser extension
eparaksts-token-signing
AUR
.
Smart-ID
To use the eID card with Smart-ID, install the following packages:
web-eid-native
AUR
- Native component communicating with all browsers
web-eid-chrome
AUR
or
web-eid-firefox
AUR
- Browser extensions that communicate with the native component
Romania
Start/enable
pcscd.service
Install
idplugclassic-ro-cei-bin
AUR
.
Launch the client from
/usr/bin/idplugclassic/identitymanager
Refer to the
Romanian eID
wiki page for further installation tips and troubleshooting.
Firefox
Navigate to
Edit > Preference > Advanced > Certificates > Security Devices
and click
Load
to load a module using
/usr/lib/idplugclassic/libidplug-pkcs11.so
. You can assign any name to it, i.e.
RO CEI PKCS#11 Module
.
Issues with performance
Refer to the
Romanian eID
wiki page.
Spain
DNI electrónico (DNIe)
Install
ca-certificates-dnie
AUR
. To sign documents using your identity card, install
autofirma
AUR
.
Sweden
BankID
is the leading electronic identification in Sweden.