SSH CA using a Yubikey

yubikey-ssh-ca.sh

#!/bin/sh

set -e
set -x

openssl genrsa 2048 > ca.key
yubico-piv-tool -s9c -aimport-key < ca.key
openssl req -x509 -days 3650 -sha256 -subj "/CN=SSH CA" -key ca.key | yubico-piv-tool -s9c -S"/CN=SSH CA" -averify -aimport-certificate

# Sign with:
#  ssh-keygen -s id_ca.pub -D opensc-pkcs11.so -I ID PATH_TO_PUBKEY
#
# Get id_ca.pub:
#  ssh-keygen -i -m PKCS8 -f <(yubico-piv-tool -s9c -aread-certificate | openssl x509 -pubkey -noout)
#
# Combined:
#  ssh-keygen -s <(ssh-keygen -i -m PKCS8 -f <(yubico-piv-tool -s9c -aread-certificate | openssl x509 -pubkey -noout)) -D opensc-pkcs11.so -I ID PATH_TO_PUBKEY