This note shows how to install the Estonian Electronic Identity Software on Debian 10 “Buster”.

Update 20191023: Although not officially supported, RIA decided to modify their software in a way that it also runs on Debian 10 Buster. The following is not needed any more as the installer script is working now out of the box.

1 ID-software – What is this?

ID-software allows you to use your ID-card electronically – use private and governmental e-services, digitally sign documents and encrypt documents for safe transfer. During ID-software installation 3 programs are installed into your computer: ID-card utility, DigiDoc4 client and DigiDoc4 crypto. With ID-card utility you can check the functioning of your ID-card and certificate validity, change PIN and PUK codes. The ID-card utility window displays the ID-card owner’s data and ID-card validity data. This information is constantly visible when ID-card utility is running. ID-card utility enables you to perform actions with certificates (extend them, change and unblock PIN codes and PUK code), configure @eesti.ee email address.

2 Installation

2.1 Add repository with installer script

The following targets Debian 10 only. For completeness see also the official Ubuntu instructions.

1. Download the installer script install-open-eid.sh.

   The installer script is hosted on linux-installer/install-open-eid.sh at master · open-eid/linux-installer · GitHub ¹

   wget https://raw.githubusercontent.com/open-eid/linux-installer/master/install-open-eid.sh

2. Modify installer script

   • Search for:

     # Debian lacks https support for apt, by default
     sudo apt-get install apt-transport-https
     case $codename in

     Replace with:

     # Debian lacks https support for apt, by default
     sudo apt-get install apt-transport-https
     case $codename in
       wheezy)
         add_repository trusty
         ;;
       stretch)
         add_repository xenial
         ;;
       buster)
         add_repository cosmic
         ;;

   • Disable Chrome support.²

     Search for:

      make_install open-eid chrome-token-signing-policy 

     Replace with:

      #make_install open-eid chrome-token-signing-policy

   • Search for:

      /usr/bin/esteid-update-nssdb

     Replace with:

      #/usr/bin/esteid-update-nssdb

3. Grant execution permissions:

   chmod 775 install-open-eid.sh

4. Execute installer script:

   ./install-open-eid.sh

2.2 Install broken “awp”-package

At the time of writing this note the awp-package is broken. Use the following workaround³:

   sudo apt update
   sudo apt install awp

The above command will finish with an error message.

   sudo /var/lib/dpkg/info/awp.postinst 
   sudo rm /var/lib/dpkg/info/awp.postinst 
   # Just in case:
   sudo dpkg --configure awp
   sudo apt-get install -yf

2.3 Install Open-EID meta package

Once the broken awp is installed successfully, the remaining packages can be installed.

   sudo apt install open-eid

The open-eid meta-package will install the following packages: awp, chrome-token-signing, firefox-pkcs11-loader, libdigidoc-tools, libdigidocpp-tools, libnss3-tools, qdigidoc-tera and qdigidoc4.

3 Testing

1. Make sure the smart card service is in status “active”:

    sudo service pcscd status 

   Check success:

    Jul 15 04:56:56 myhost systemd[1]: pcscd.service: Succeeded.

   If necessary start it with:

    sudo service pcscd start

2. Digidoc4

   1. Insert ID card in card-reader.

   2. Launch Digidoc4 application

      qdigidoc4

   3. Check: in the first line your name should appear and next to your “Isikukood” the text “ID-card in card reader” is displayed.

3. Firefox plugin

   Close all Firefox instances and start Firefox again.

   To check if the Digidoc Open-EID extensions are properly installed in Firefox Quantum, open in the main menu: Tools->Add-ons->extensions.

   Here you should see two extensions loaded:

   • Firefox PKCS11 loader (Configures Firefox to use PKCS11 for authentication)
   • Token signing (Use your eID smart card on the web)

   Now you should be able to connect to your bank using your ID-card.