12

So let me set the stage:

I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html

I made a couple changes, instead of the Digital Signature slot, I used the Card Authentication slot. The reason for that is, by the spec and Yubikey's documentation it appears:

This certificate and its associated private key is used to support additional physical access applications, such as providing physical access to buildings via PIV-enabled door locks. The end user PIN is NOT required to perform private key operations for this slot.

So that seems great, however it appears in order to interact with this slot, my openssl/pkcs11 configuration requires a PIN anyways. I could simply include the PIN in any scripted interactions with the CA but this just doesn't seem correct.

Has anyone experienced this, and or worked around it?

Improve this question
2
  • 2
    Just to get a use case straight: you want to create a CA that doesn't require any authentication for issuing certificates? That doesn't sound right to me in the first place.
    – Maarten Bodewes
    Dec 2, 2016 at 16:46
  • The idea is that I want to have a CA without having to store a PIN for the other cardslots on the filesystem (or an API key for a secrets manager.) It also means you can't use the certificate for EAPOL authentication without entering a pin, which is silly if you want to use a virtual smartcard (for instance.)
    – Ori
    Dec 2, 2016 at 22:09

1 Answer 1

Reset to default
1

The sole purpose of a CA is to issue digital signatures, specifically to sign the public keys of subordinate certificates; Choosing a key function other than "digital signature" is contrary to this purpose.

Shouldn't you have the CA cert in the Digital Signature slot, and then a subordinate certificate (trusted by the EAPOL device) in the card-auth slot?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .