3 ms·
The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if
by tomatocracy 4y ago
The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent:
ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh
( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys
name="temp-$(date +%Y%m%d-%H%M)"
ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name}
ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub
ssh-add -t 1d ${name}
rm -f ${name} ${name}.pub ${name}-cert.pub
[0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.html https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...