Skip to content

Instantly share code, notes, and snippets.

@carlchan

carlchan/yubikey-ssh-ca.sh

Created September 24, 2019 14:36
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save carlchan/fd9cb5a2485e3425db3ac122c671878f to your computer and use it in GitHub Desktop.
Save carlchan/fd9cb5a2485e3425db3ac122c671878f to your computer and use it in GitHub Desktop.
Download ZIP
SSH CA using a Yubikey
Raw
yubikey-ssh-ca.sh
#!/bin/sh
set -e
set -x
openssl genrsa 2048 > ca.key
yubico-piv-tool -s9c -aimport-key < ca.key
openssl req -x509 -days 3650 -sha256 -subj "/CN=SSH CA" -key ca.key | yubico-piv-tool -s9c -S"/CN=SSH CA" -averify -aimport-certificate
# Sign with:
# ssh-keygen -s id_ca.pub -D opensc-pkcs11.so -I ID PATH_TO_PUBKEY
#
# Get id_ca.pub:
# ssh-keygen -i -m PKCS8 -f <(yubico-piv-tool -s9c -aread-certificate | openssl x509 -pubkey -noout)
#
# Combined:
# ssh-keygen -s <(ssh-keygen -i -m PKCS8 -f <(yubico-piv-tool -s9c -aread-certificate | openssl x509 -pubkey -noout)) -D opensc-pkcs11.so -I ID PATH_TO_PUBKEY
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment