Mac OSX Sonoma

Smart Card Reader Issues Tracker for Sonoma

Overview

Starting from OSX Sonoma, smart card readers for Mac can fail for the following use cases:

• detect card reader

• execute transaction (digital signature or authentication)

The general end-user experience is that the smart card communication fails (card reader disseappears or the transaction fails).

A very great shout-out to Ludovic Rousseau who initially did a follow-up on impact of smart card readers in Sonoma:

macOS Sonoma and smart cards statusLudovic Rousseau's blog

Reported Bug to Mac OSX:

macOS Sonoma bug: SCardControl() returns SCARD_E_NOT_TRANSACTEDLudovic Rousseau's blog

OSX Forum

MacOS 14 (Sonoma) Smart Card Reade… | Apple Developer Forumsforums.developer.apple.com

Solution

The initial solution prior to 11/2023 was very elaborate, but was made easy by applying a single command in a MAC OSX terminal:

$ sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool yes

What does the command execute/change?

The command switches the MAC OSX implementation of the CCID drivers to the legacy version (the version working prior to Sonoma).

As MAC OSX defaults using a custom CCID implementation, which still have some issues, switching to the old version is a temporary stolution.

How to roll-back to MAC OSX CCID implementation?

Form a specific moment (not at the time of writing), switching back to the default CCID implementation can be done using the following commands (in a terminal):

Check if the built-in Apple CCID driver is active

defaults read /Library/Preferences/com.apple.security.smartcard.plist useIFDCCID

If the former command results in:

he domain/default pair of (/Library/Preferences/com.apple.security.smartcard.plist, useIFDCCID) does not exist

This means that the built-in Apple driver is active.

The result is 1 so the "external" (non-Apple) CCID driver is enabled.

Returning back to default, execute:

sudo defaults write /Library/Preferences/com.apple.security.smartcard useIFDCCID -bool no

After executing a driver switch, we have noticed that a restart is mandatory!