The ssh-keygen manpage lists the following two parameters:

-D reader = Download the RSA public key stored in the smartcard in reader.

-U reader = Upload an existing RSA private key into the smartcard in reader.

I can't find out anything else about these after searching around. Do they support a standard ssh_rsa keypair on a smartcard, or do they work with a pkcs11 interface and x509 formatted certificates. Is this related to ssh certificates and able to support storing either the private signing-key or private user-key-with-certificate on a smartcard?

In short, why would I use these parameters?


I think I found the information I was looking for on a more detailed man page. The man page is here (freebsd man page).

It sounds like the -D and -U parameters talk to a pkcs11 device, and these options do indeed work with ssh certificates (via the -s parameter). Using these it should be possible to have an offline, smartcard protected ssh ca signing key (which was my original goal). I don't know if it is possible to have a signed user key on a smart card with this process yet.

I have not tried any of these commands yet, but I think that they are what I was looking for. If all goes well this will allow me to setup an offline ssh ca on a yubikey neo.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy