3 ms·
What do people use for doing TLS client certificates with the Yubikey? I’ve tried: - Yubikey as PIV token, works well on Windows, other OSes require OpenSC, do
by madjam002 8y ago
What do people use for doing TLS client certificates with the Yubikey? I’ve tried:
- Yubikey as PIV token, works well on Windows, other OSes require OpenSC, doesn’t play nicely if you want to use GPG as well
- Yubikey as GPG token only, and using Scute as a PKCS11 emulator on top of GPG agent.
I’m currently using the scute method, but it doesn’t play that well with Windows (Cryptographic Service Provider), and Scute itself doesn’t seem that well used or maintained. Ideally I’d be able to use my Yubikey as a GPG card and have seemless TLS client auth and Windows Smartcard logon.
- mcpherrinm 8y agoWe use https://github.com/square/ghostunnel https://github.com/square/ghostunnel with yubikeys with client certs, on Linux and Windows boxes for client connections.
- jktr 8y ago> doesn’t play nicely if you want to use GPG as well I just ran into this a few days ago. I was having a hard time debugging why the token would randomly lock up when I tried to do client auth in firefox/opensc while the yubikey had PGP mode unlocked. > Scute Thanks for the pointer! This seems to be exactly what I was looking for.
- madjam002 8y agoNo worries, there’s also scd-pkcs11 that I’ve had a quick look at, but I think that requires you to upload a cert to the card itself rather than storing it on disk, and for some reason the Yubikey 4 can only store at most a 1.3K cert for GPG, which is not enough if you have a 4096 bit public key and issuer.