Romanian eID

This page refers to the Romanian eID (electronic identity card) colloquially known as "CEI" (Cartea Electronica de Identitate), specifically its applications on Arch Linux systems, as well as installation guidelines and troubleshooting tips.
For general information referring to electronic identification on Arch Linux, specifically through government-issued cards, visit
Electronic identification
.
As of today, the only driver interface known to work with CEI is a proprietary solution issued freely by the Romanian government and available at
https://hub.mai.gov.ro/aplicatie-cei
. Sources (namely Andrei Nicoara on behalf of OrchestrateID) claim to have developed an interface for CEI using only open ISO standards
citation - linkedin post
, but no proof has been made to back this claim, and it is unlikely the specific ISO standards will be disclosed by the developers of OrchestrateID.
The app bundled with the drivers, available at
idplugclassic-ro-cei-bin
AUR
is used to display on-chip information, i.e. a set of all visible information printed on the polycarbonate card itself, alongside domicile and residence information, which can only be seen on chip. The app also facilitates changing the PIN numbers, seeing and exporting information on the cryptographic certificates public keys, and loading other certificates when used in combination with write-friendly smartcard readers. The PUK codes for the onboard certificates are not made known to the user, instead the user has to show up in person to any SPCEP office or Romanian embassy/consulate to be identified pending a PIN code reset.
The card is equipped with 2 certificates, bearing Advanced Electronic Signature status in the EU, as well as full equivalence to a handwritten signature under Romanian jurisdiction, under Law 214/2024. The certificates are used for TLS Authentication and respectively PAdES/PKCS#7/XAdES/etcetera file signature protocols. The resulting signatures are used to authenticate the signer as well as guarantee file integrity. Files signed with such a signature bear full legal obligations similar to a handwritten signature, under Romanian and EU jurisdictions. Romanian citizens can also use the authentication certificate to log into governmental and private digital platforms, for secure and legally binding operations. We strongly recommend unplugging the smartcard from your system immediately after use, to stop potential bad actors from legally acting on your behalf using the CEI certificates by interfacing with it.
Installation
Start/enable
pcscd.service
Install
idplugclassic-ro-cei-bin
AUR
.
Depending on the smartcard reader, specific drivers relating to it might also be needed for proper functioning. Use the idplugclassic GUI application to test for smartcard access. Most USB readers are plug-and-play on Arch Linux, given that
linux-firmware
is installed a priori.
Software Integration
NSS database
Append
the following lines, to the
pkcs11.txt
file located at the root of the NSS databse folder:
pkcs11.txt
...
[file contents]
...

library=/usr/lib/idplugclassic/libidplug-pkcs11.so
name=RO CEI
Firefox
CEI can be used in Firefox for TLS authentication in government platforms.
Navigate to
Edit > Preference > Advanced > Certificates > Security Devices
and click
Load
to load a module using
/usr/lib/idplugclassic/libidplug-pkcs11.so
. You can assign any name to it, i.e.
RO CEI PKCS#11 Module
.
Chromium-based browsers
CEI can be used in Chromium-based for TLS authentication in government platforms.
Chromium-based browsers utilize (usually) the built-in NSS database located at
$HOME/.pki/nssdb
, where CEI can be added as described above.
Okular
CEI can be used in Okular for document signing, commonly for PDF format files using PAdES type signatures.
Start by adding CEI to any valid NSS database of choice as described above, then, inside the Okular graphic user interface, navigate to
Settings > Configure Backends > PDF
and ensure the following settings are set correctly on this page:
Check revocation of digital signatures' certificates using 3rd-party servers: ON
Signature Backend: NSS
Certificate Database: Custom: {absolute file path to your preferred NSS database}
Troubleshooting
Freezes and Crashes on PIN input
Some reputable users have been able to replicate an issue in which programs utilizing the card for cryptographic operations freeze or take several seconds before prompting for a pin, leading to crashes or annoyances. As the interface is momentarily closed-source, we cannot intervene to fix the issue from its origin, but a common fix is creating a new, empty NSS database using
certutil -N -d
file/path/of/new_db
and then appending the proper lines to the file
pkcs11.txt
as described in the NSS database integration instructions above. Subsequently cleaning your Firefox profile's
pkcs11.txt
file may help with this issue, as reported by some users.