...

2 - Prepare

...

Step 1 - activate CCID

Activate the USB interface CCID on the Yubikey. To install the Yubikey manager check https://developers.yubico.com/yubikey-manager/.

Activate the mode using:

ykman mode CCID

...

CA server

Step 1 - Install libraries that are later used

To setup the yubikey the yubico-piv-tool is used. It must be installed from source to work correctly. For the installation the following packages are needed:

apt-get install git cmake build-essential libtool libssl-dev pkg-config check libpcsclite-dev gengetopt help2man

Step

...

2 - Install the yubico-piv-tool

git clone https://github.com/Yubico/yubico-piv-tool.git

cd yubico-piv-tool

mkdir build; cd build
cmake ..
make
sudo make install

Step

...

3 - Install the yubikey-manager

To install the Yubikey manager check https://developers.yubico.com/yubikey-manager/.

3 - Prepare Yubikey

Step 1 - Activate CCID

Activate the USB interface CCID on the Yubikey. Activate the mode using:

ykman mode CCID

Step 2 - Change default pins and management key of yubikey

To prepare the PIV applet in the YubiKey the management key, the pin and the punk needs to be set.

yubico-piv-tool -a set-mgm-key -n 010203040506070801020304050607080102030405060708
yubico-piv-tool -k $key -a change-pin -P 123456 -N 123456
yubico-piv-tool -k $key -a change-puk -P 12345678 -N 12345678

Step

...

3- Generate RSA private keys for SSH Host CA

Then generate a RSA private key for the SSH Host CA, and generate a dummy X.509 certificate for that key. The only use for the X.509 certificate is to make PIV/PKCS#11 happy. They want to be able to extract the public-key from the smart-card, and do that through the X.509 certificate.

YUBIKEYNUM=0
PATH_TO_CERTIFICATE="/etc/ssh-ca"

mkdir -p $PATH_TO_CERTIFICATE

# generate key directly on yubikey and self-sign the certificate
yubico-piv-tool -k 123456 -s 9c -a generate -o yubikey$YUBIKEYNUM.pem
yubico-piv-tool -k 123456 -a verify-pin -a selfsign-certificate --valid-days 10000 -s 9c -S "/CN=yubikey`$YUBIKEYNUM`/" -i yubikey$YUBIKEYNUM.pem -o yubikey$YUBIKEYNUM-cert.pem
# import self-signed certificate
yubico-piv-tool -k 123456 -a import-certificate -s 9c -i yubikey$YUBIKEYNUM-cert.pem

# convert public key to RSA
ssh-keygen -f yubikey$YUBIKEYNUM.pem -i -mPKCS8 > yubikey$YUBIKEYNUM.pub

# move public key to correct place and remove leftovers
mv yubikey$YUBIKEYNUM.pub $PATH_TO_CERTIFICATE 
rm yubikey$YUBIKEYNUM-cert.pem yubikey$YUBIKEYNUM.pem

...

4 - Sign client's public keys

To sign client's public keys there is the script 'generate_client_certificate.sh' to simplify the procedure.
The scripts does have the following options:

...

The output of 'generate_client_certificate.sh' is a .tar archive that contains the certificate, the public key that is used to authenticate servers as well as an instruction to install the certificate on the client's machine. It is stored in the home directory '$HOME/signed_keys'.

4 - Sign hosts's public keys

To sign host's public keys there is the script 'generate_host_certificate.sh' to simplify the procedure.
The scripts does have the following options:

• -I
  • This takes the HOST_ID of the server.
  • e.g host.netdef.org
• -f
  • The file that contains all the keys.
• -V
  • Add the validity interval of a certificate
  • Per default a certificate is valid for one year.
  • More information can be found here: validity_interval
• -n
  • This flag restricts the certificate to a list of principals that the host is known by.

The output of 'generate_host_certificate.sh' is the certificate 'HOST_ID-cert.pub' that needs to be copied to the host. It is stored in the home directory '$HOME/signed_keys'.

...

5 - Troubleshooting

Export public key

PATH_TO_YKCS11="/usr/local/lib/libykcs11.so"
ssh-keygen -D PATH_TO_YKCS11 -e

...