I have my ssh keys within a yubikey, I use gpg-agent.conf with something like this:

pinentry-program /usr/local/bin/pinentry-mac
default-cache-ttl 60
max-cache-ttl 120

This helps me to ssh into any host without having the private key in a file like ~/.ssh/id_rsa.

But in some cases, like when using tools like ssh-vault, ansible-vault, etc, they need to read the key on file ~/.ssh/id_rsa therefore wondering if there is a way to call the gpg-agent to retrieve the key when trying to read from the ~/.ss/id_rsa, or other ways to retrieve the private keys.

  • Wouldn’t that defeat the purpose of storing the keys on a hardware token? Why can these programs not use an SSH agent?
    – Daniel B
    Mar 11, 2019 at 12:07
  • True, indeed I think the point here is implementing the agent-support, but if I am right there is no way to extract the private key from the agent
    – nbari
    Mar 11, 2019 at 12:28

1 Answer 1


No, there is no way to get the private key out of a yubikey. This is by design for security reasons.

The way to go with this is to use ssh-agents instead. If they are able to use ssh-agent it is very easy to add your yubikey to it. For OpenSSH its just:

ssh-add -s <your-pkcs11.so>

Then you can just point you software towards the SSH agent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.