These are my notes on configuring Rocky Linux 10 to authenticate to Microsoft 365 using a smart card and Microsoft Edge. This allows me to access Microsoft 365 web applications, including Outlook and Teams, using certificate-based authentication.
The following documents the configuration I verified in November 2026.
Install Microsoft Edge
Import the Microsoft package-signing key:
sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
Configure the Microsoft Edge repository:
sudo tee /etc/yum.repos.d/microsoft-edge.repo > /dev/null <<'EOF' [microsoft-edge] name=Microsoft Edge baseurl=https://packages.microsoft.com/yumrepos/edge/ enabled=1 gpgcheck=1 repo_gpgcheck=0 gpgkey=https://packages.microsoft.com/keys/microsoft.asc EOF
Install Microsoft Edge:
sudo dnf install -y microsoft-edge-stable
Install Smart Card Support
Install the PC/SC smart-card infrastructure, OpenSC middleware, and Public-Key Cryptography Standards #11 (PKCS#11) libraries:
sudo dnf install -y \ pcsc-lite \ pcsc-lite-ccid \ opensc \ opensc-libs \ nss-tools \ p11-kit
Enable the PC/SC smart-card service:
sudo systemctl enable --now pcscd.socket
Verify Smart Card Detection
Insert the smart card into the reader and verify that Rocky Linux recognizes it:
opensc-tool --list-readers
The output should identify the reader and show Yes in the Card column:
# Detected readers (pcsc)
Nr. Card Features Name
0 Yes <Smart Card Reader>
Verify that OpenSC can access the smart card through the PKCS#11 interface:
pkcs11-tool \ --module /usr/lib64/pkcs11/opensc-pkcs11.so \ --list-slots
For a compatible, initialized smart card, the output should identify the token and its authentication requirements.
Verify that OpenSC is registered with the system-wide PKCS#11 infrastructure:
p11-kit list-modules
The output should include:
module: opensc
path: /usr/lib64/pkcs11/opensc-pkcs11.so
On my Rocky Linux 10 workstation, OpenSC was already registered through p11-kit. No additional module registration was required.
Authenticate to Microsoft 365
Launch Microsoft Edge and navigate to your organization’s Microsoft 365 portal.
For example, organizations using commercial Microsoft 365 may use:
microsoft-edge-stable https://www.microsoft365.com/
The appropriate URL depends on the organization’s Microsoft 365 environment.
I completed authentication using the same certificate-based process available on Windows:
- Enter organizational email address.
- Select the appropriate smart-card authentication certificate.
- Enter smart-card PIN.
After authentication, I accessed my Microsoft 365 Outlook calendar and joined a Microsoft Teams meeting using a link from a calendar invitation.
The availability of certificate-based authentication depends on the organization’s identity provider and authentication policies.
Verified Configuration
| Component | Verified configuration |
| Operating system | Rocky Linux 10 (x86-64) |
| Browser | Microsoft Edge 157.0.4341.46 |
| Smart-card reader | Broadcom 58200 |
| Smart-card middleware | OpenSC 0.26.1 |
| PKCS#11 integration | OpenSC with system-wide p11-kit |
Additional Notes
The configuration worked with Rocky Linux 10’s standard smart-card packages. No Microsoft Identity Broker installation or manual Network Security Service (NSS) module registration was required.
This procedure documents a working configuration with a compatible smart card and an organization-managed Microsoft 365 environment. Other smart-card models and Microsoft 365 environments may require additional configuration.