Trouble Setting Up CA on RPi4B with YubiKey 5 Nano

[AlexLandherr]

Hi,

I'm in the process of setting up a CA using this guide:
Smallstep CA on RPi

Please note that I don't have the Infinite Noise TRNG for financial reasons.

I had to use this version of Ubuntu server since the link for Ubuntu in the guide is dead as of writing this (direct download link to version I used):
Ubuntu Server 22.04 ARM64

and am having trouble at the "Import the CA Into the Yubikey" section. I get this warning at the ykman piv certificates import 9a /mnt/ca/certs/root_ca.crt command:

WARNING: PC/SC not available. Smart card protocols will not function.
Error: No eligiable connections are available ([<class 'yubikit.core.smartcard.SmartCardConnection'>]).

And this is what sudo ykman info gives me:

pi@tinyca:~$ sudo ykman info
WARNING: PC/SC not available. Smart card protocols will not function.
Device type: YubiKey 5 Nano
Serial number: 13833527
Firmware version: 5.4.3
Form factor: Nano (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID

Applications
FIDO2 Enabled
OTP Enabled
FIDO U2F Enabled
OATH Enabled
YubiHSM Auth Enabled
OpenPGP Enabled
PIV Enabled

And I can see that the pcscd daemon starts up and then shuts down for reasons unknown to me:

pi@tinyca:~$ journalctl -u pcscd
Jul 13 17:21:57 tinyca systemd[1]: Started PC/SC Smart Card Daemon.
Jul 13 17:22:58 tinyca systemd[1]: pcscd.service: Deactivated successfully.
Jul 13 17:23:48 tinyca systemd[1]: Started PC/SC Smart Card Daemon.
Jul 13 17:25:39 tinyca systemd[1]: pcscd.service: Deactivated successfully.

I have been very careful to install the pcscd package as noted under "Install Prerequisite: ykman".

What could I be doing wrong? Is it a must to use the Yubikey 5 NFC and impossible to use any other model?

[tashian]

Using it with the YubiKey 5 Nano should work, since that model supports PIV.

It looks like pcscd may be running with the auto-exit option, and it's exiting after 60 seconds of inactivity.
Take a look at the flags being passed to it?

[AlexLandherr]

Hi,
Thanks for the reply!

As a beginner learning about CA's how do I check which flags are passed to it?

[tashian]

Well, I was just looking at the pcscd service unit (/lib/systemd/system/pcscd.service) and it does use the auto-exit flag. And that's okay, because it's using systemd's "socket activation" feature to restart pcscd on-demand, whenever any client tries to connect to it.

So, I don't think pcscd is your issue.

My hunch would be that it's either an issue with the YubiKey itself (I've never tested this with the Nano so I can't confirm 100% that it works), or with ykman or how it's configured (maybe it can't find a local PC/SC library, for example).

I'd suggest opening an issue on Yubico's repo for this.

[AlexLandherr]

Ok, have now done that.

[AlexLandherr]

Well, I was just looking at the pcscd service unit (/lib/systemd/system/pcscd.service) and it does use the auto-exit flag. And that's okay, because it's using systemd's "socket activation" feature to restart pcscd on-demand, whenever any client tries to connect to it.

So, I don't think pcscd is your issue.

My hunch would be that it's either an issue with the YubiKey itself (I've never tested this with the Nano so I can't confirm 100% that it works), or with ykman or how it's configured (maybe it can't find a local PC/SC library, for example).

I'd suggest opening an issue on Yubico's repo for this.

I ran sudo systemd start pcscd which then let me continue. Thanks for the help!

[bintyrant]

It's a bug with pcscd in 22.04 which can be worked around for now by enabling pcscd.socket in systemd

sudo systemctl enable pcscd.socket
sudo systemctl start pcscd.socket

https://bugs.launchpad.net/ubuntu/+source/pcsc-lite/+bug/1971984

[AlexLandherr]

Another related question; when I run sudo ykman change-puk it asks for my current PUK, which in the guide I linked to doesn't seem to be something I set manually. Is there a default PUK for the YubiKey 5 Nano?

[bintyrant]

12345678

https://developers.yubico.com/PIV/Introduction/YubiKey_and_PIV.html