You can use this great-but-also-terrible system to do X509 certificate validation with SSH: https://github.com/mjg59/ssh_pki Maybe after some deeper security analysis this idea could help you work around the limitations of Yubikey's hardware.

However, if the author of a piece of security software tells me something is a bad idea, I tend to accept that, especially if that author is mjg59.

@jeroenhd Mea-culpa, had a choice of two smallstep bookmarks and I copy/pasted the wrong one ! Now corrected.

As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).

Would love to know more about this workflow!

It's pretty much a combination the following:

- https://keepassxc.org/docs/#faq-ssh-agent-how

- https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).

The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent:

  ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh
  ( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys
  name="temp-$(date +%Y%m%d-%H%M)"
  ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name}
  ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub
  ssh-add -t 1d ${name}
  rm -f ${name} ${name}.pub ${name}-cert.pub

[0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...

You can sign yubikey-hosted FIDO keys in OpenSSH just fine.

A FIDO token can also act as CA, though the certificates it issues will be limited to use by relatively recent SSH versions as FIDO support was only added in 2019.

using yubikeys in fido2 as the CA key just works, and the cert is its public key

what doesn't work is storing the signed certificates