Generating the root key on the Yubikey
List all the keys known on the host:
❯ notary -d ~/.docker/trust key list
You probably don't have any keys available yet. Let's generate one.
Create an 256-bit ECC key pair:
❯ yubico-piv-tool -s 9c -a generate -k --pin-policy=always --touch-policy=always --algorithm=ECCP256 -o public.pem
Enter Yubikeys Management key.
Create a self-signed certificate (or, alternatively, a certificate signing request):
❯ yubico-piv-tool -a verify-pin -a selfsign-certificate -s 9c -S '/CN=root/' --valid-days=365 -i public.pem -o cert.pem
Enter PIN then touch the Yubikey.
request-certificateand send the resulting
.csrfile for internal CA certification.
CN=rootis what allows Notary to find the key on the Yubikey, so it should be kept that way.
Import the (self-)signed certificate:
❯ yubico-piv-tool -k -a import-certificate -s 9c -i cert.pem
Enter Yubikey's Management key.
You can choose to generate the private key outside the Yubikey, in case you prefer to have a local backup copy.
notary key generate will generate a private key locally and then find an empty slot to import it on the Yubikey.
When Notary asks for the SO PIN, enter the Yubikey's Management Key.
You should now have the
root key available:
❯ notary -d ~/.docker/trust key list ROLE GUN KEY ID LOCATION ---- --- ------ -------- root bf98cc496cb05fd2b88b01d3200900ff05ec83a1f3690690f… Yubikey