TL;DR — go to the Howto section to make WatchData PROXKey work with emSigner in GNU/Linux system.
Hardware tokens with digital signature are used for filing various financial documents in Govt of India portals. The major tokens supported by eMudhra are WatchData ProxKey, ePass 2003, Aladdin, Safenet, TrustKey etc. Many of these hardware tokens come (in CDROM image mode) with drivers and utilities to manage the signatures, unfortunately only in Windows platform.
Sometime in 2017, I tried to make these tokens work for signing GST returns under GNU/Linux, using the de-facto
pcsc tool. I got a WatchData PROXKey, which doesn’t work out-of-the-box with
pcsc. Digging further brings up this report and it seems the driver is a spinoff of upstream (LGPL licensed), but no source code made available, so there is no hope of using these hardware tokens with upstream tools. The only option is depending on vendor provided drivers, unfortunately. There are some instructions by a retailer to get this working under Ubuntu.
Once you download and install that driver (
ProxKey_Redhat.rpm), it does a few things — installs a separate
pcsc daemon named
pcscd_wd, installs the driver CCID bundles and certain supporting binaries/libraries. (The drawback of such custom driver implementations is that different drivers clash with each other (as each one provides a different
pcscd_wd binary and their installation scripts silently overwrite existing files!). To avoid any clashes with this
pcscd_wd daemon, disable the standard
pcscd daemon by
systemctl stop pcscd.service.
Plug in the USB hardware token and to the dismay observe that it spews the following error messages in
Oct 06 09:16:51 athena pcscd_wd: ifdhandler.c:134:IFDHCreateChannelByName() failed Oct 06 09:16:51 athena pcscd_wd: readerfactory.c:1043:RFInitializeReader() Open Port 0x200001 Failed (usb:163c/0417:libhal:/org/freedesktop/Hal/devices/usb_device_163c_0417_serialnotneeded_if1) Oct 06 09:16:51 athena pcscd_wd: readerfactory.c:335:RFAddReader() WD CCID UTL init failed.
This prompted me to try different drivers, mostly from the eMudhra repository — including
Trust Key and even
ePass (there were no *New* drivers at this time) — none of them seemed to work. Many references were towards Ubuntu, so I tried various Ubuntu versions from 14.04 to 18.10, they didn’t yield different result either. At this point, I have put the endeavour in the back burner.
A renewed interest
Around 2019 September, KITE announced that they will start supporting government officials using digital signatures under GNU/Linux, as most of Kerala government offices now run on libre software. KITE have made the necessary drivers, signing tools and manuals available.
I tried this in a (recommended) Ubuntu 18.04 system, but the
pcscd_wd errors persisted and
NICDSign tool couldn’t recognize the PROXKey digital token. Although, their installation methods gave me a better idea of how these drivers are supposed to work with the signing middleware.
Couple of days ago, with better understanding of how these drivers work, I thought that these should also work in Fedora 30 system (which is my main OS), I set out for another attempt.
- Removed all the
ProxKey_Redhatand such drivers, if installed; to start from a clean slate.
WatchData ProxKey (Linux) *New*driver from eMudhra.
- Unzip and install
Note that this package installs theUpdate: the
/usr/lib/WatchData/ProxKey/lib/libwdpkcs_SignatureP11.so) and it seems the ProxKey token only works with
libwdpkcs_SignatureP11.solibrary works fine for ProxKey, it is the
emSignerbinary that doesn’t look for it.
- To make
emSignerwork, symlink to one of the libraries it checks for (ensure target directory doesn’t exist because you installed another driver):
mkdir -p /usr/lib/WatchData/TRUSTKEY/lib/; ln -s /usr/lib/WatchData/ProxKey/lib/libwdpkcs_SignatureP11.so /usr/lib/WatchData/TRUSTKEY/lib/libwdpkcs_TRUSTKEY.so
systemctl start pcscd_wd.service(only if not auto-started)
- Plug in your PROXKey token. (
journalctl -fwould still show the error message, but — lesson learned — this error can be safely ignored!)
emsignerfrom GST website and unzip it into your
~/Documentsor another directory (say
- Ensure port
1585is open in firewall settings:
firewall-cmd --add-port=1585/tcp --zone=FedoraWorkstation(adjust the firewall zone if necessary). Repeat the same command by adding
--permanentto make this change effective across reboot).
- Go to
~/Documents/emSignerin shell and run
./startserver.sh(make sure to
chmod 0755 startserver.sh, or double-click on this script from a file browser). Note that you’d need
openjdk-1.8or Oracle java due to
- Login to GST portal and try to file your return with DSC.
- f you get the error
Failed to establish connection to the server. Kindly restart the Emsignerwhen trying to sign, open another tab in browser window and go to
https://127.0.0.1:1585and try signing again (don’t use
localhost, as it would cause self-signed certificate mismatch).
- You should be prompted for the digital signature PIN and signing should succeed.
It is possible to use this digital token also in Firefox (via
Preferences → Privacy & Security → Certificates → Security Devices → Load with
Module filename as
) as long as the key is plugged in. Here again, you can skip the error message
unable to load the module. Update: this error message is caused by a permission issue of
pkcs11.txt file in firefox profiles directory, change that file’s owner to your user.