> Can you recommend a setup guide? Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at s

> Can you recommend a setup guide? Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at something along the following lines of the below (the below is based off my rough notes, I might have missed something). Note that I have ignored any Yubikey setup considerations here like setting PIN, touch-requirement etc. etc. I have also assumed plain Yubikey, not the YubiHSM. The YubiHSM comes with SSH certificate signing functionality "out of the box". Client Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $client_key.pub` Issuer Yubikey: - Use Yubikey ykman[1] to generate a PIV key according to your tastes - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $issuer_key.pub` (save this for the next step and also put it into your sshd CA config) - Sign with the issuer Yubikey with `ssh-keygen -s $issuer_key.pub -D $path_to/libykcs11 -I $whatever_identity -n $principal_list -V +$validity_period $client_key.pub` (libykcs11 is the yubikey library,it ships with yubikey-piv-tool[2]) [1] https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Commands.html https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Com... [2] https://developers.yubico.com/yubico-piv-tool/Releases/ https://developers.yubico.com/yubico-piv-tool/Releases/ ==== Edit to add links to various more verbose discussions on the subject (in no particular order): - https://liw.fi/sshca/ - https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/ - https://jamesog.net/2023/03/03/yubikey-as-an-ssh-certificate-authority/ - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-ssh_certificate_pkcs_11_token Also some verbose discussions on the possibility of doing so with FIDO2. Altough note that the native version of ssh on Apple OS X does not support FIDO2, therefore if you want native Apple support you are best sticking with the PIV method instead. - https://developers.yubico.com/SSH/Securing_git_with_SSH_and_FIDO2.html - https://medium.com/@harrishcluo/yubikey-ssh-git-super-secure-your-development-workflow-2-2-1899379fb882 - https://blog.millerti.me/2021/05/16/strengthen-github-ssh-access-with-fido2s-pin-support/