OpenSSH 5.4 was released on 2010-03-08, and that is when the project added support for certificate authentication of users and hosts using an OpenSSH certificate format (not X.509)
Why am I telling you this? Because I wanted to find out since when exactly I have been putting off actually experimenting with SSH certificates, and I can now with certainty say that as far as this topic is concerned I've been an idiot over the last 16 years!
This is a guide to setting up a YubiKey for use as an offline SSH certificate authority. This assumes a brand new YubiKey with no prior configuration on it, to be used solely as a CA. Why? Typically a CA should be on a secured, isolated machine. Using a dedicated YubiKey means you can isolate your CA and keep it in a drawer so that it can’t be accessed. YubiKeys offer protections such as requiring a PIN and/or touching the key for PIV operations.
@jamesog very good writeup and thank you.
I see you've added stuff to ensure I had a coffee before starting!
I stumbled over "first" and "second" the as order is swapped. (Just a small nit.)
JP Mens
James O'Gorman