So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple changes, instead of the Digital Signature slot, I used the Card Authentication slot. The reason for that is, by the spec and Yubikey's documentation it appears:
This certificate and its associated private key is used to support additional physical access applications, such as providing physical access to buildings via PIV-enabled door locks. The end user PIN is NOT required to perform private key operations for this slot.
So that seems great, however it appears in order to interact with this slot, my openssl/pkcs11 configuration requires a PIN anyways. I could simply include the PIN in any scripted interactions with the CA but this just doesn't seem correct.
Has anyone experienced this, and or worked around it?