Setting up smallstep with Yubikey

[nidkil]

Hi,

I'm folllowing the blog post Build a Tiny Certificate Authority For Your Homelab. In Part 3: Configuring Your CA I'm getting the following error when I try to start step-ca.

authority.GetTLSCertificate: error creating certificate: command failed: smart card error 6a80: incorrect parameter in command data field

This is my configuration:

{
        "root": "/etc/step-ca/certs/root_ca.crt",
        "federatedRoots": [],
        "crt": "/etc/step-ca/certs/intermediate_ca.crt",
        "key": "yubikey:slot-id=9c",
        "kms": {
                "type": "yubikey",
                "pin": "123456"
        },
        "address": ":443",

Does anyone have an idea what the problem is?

Regards, nidkil

[tashian]

Hi nidkil, I haven't seen this error before.

Can you share the output of ykman info, which step-ca version you are running (and, did you build it yourself or install a binary?). Finally, which Linux distro and version are you running?

Here's a related issue (unresolved) in another piv-go project—this may be an upstream issue in go-piv/piv-go.

[nidkil]

Unfortunately I'm getting a different error :-(

authority.GetTLSCertificate: error creating certificate: command failed: smart card error 6a80: incorrect parameter in command data field

[nidkil]

@tashian is there away to enable debugging to see what is happening?

[tashian]

Yes, you can run step-ca with STEPDEBUG=1 to enable debugging output.
For PIV, I believe step-ca will call the pcscd daemon, and you can enable debugging on pcsdc with -d

[nidkil]

I've set debug with:

export STEPDEBUG=1

Not much debugging info showing... The same output is shown if I set the value to 1 or 0. I'm I doing it correctly?

[nidkil]

@tashian I wiped the system and ran through the whole setup again. Using the exact same versions as your blog post. And it worked.

I wiped the system again and ran through the setup using the latest versions. And it worked 👍

Also tried the alternative kms entry with uri in the /etc/step-ca/config/ca.json and it worked.

No idea what I did wrong in the first setup.

Thx for your help!

[nidkil]

On a side note, I setup yubikey-agent and I'm getting the same error.

sign_and_send_pubkey: signing failed for ECDSA "YubiKey #14308549 PIV Slot 9a" from agent: agent refused operation

BTW this is on a Manjaro machine.

[tashian]

Interesting. Well, I'm stumped on this one. It sounds like this is an upstream issue with either go-piv or pcsc-lite. I'm sorry you haven't been able to get it working. If you have a different YubiKey you can try it with, that may make a difference.

[nidkil]

Okay my bad, it is working. I needed to tap the Yubikey :-)

[CvW]

Glad you got it working.

FWIW, I found it significantly easier to use the Yubikey application to set the PKI and PUK, getting those saved in a password manager, etc. before setting up the rest of the internal CA. While operating the various yubikey-related commands from the CLI is a good thing to know, a GUI makes the job somewhat less error-prone for beginners like me.