Home Knowledge Base SecureW2 Documentation Security Key Integration: Installing a Certificate on a YubiKey

Security Key Integration: Installing a Certificate on a YubiKey

Introduction

IT organizations that want to leverage PIV and store their certificates on YubiKeys need key security components to simplify deployments. SecureW2 bundles together turnkey PKI services, onboarding software for end users to enroll for certificates, and authentication services.

In the SecureW2 JoinNow Management Portal, everything needed to enroll a YubiKey for a certificate can be done using the Getting Started Wizard, available under Device Onboarding > Getting Started.

Configure the Wizard with the following settings:

  1. Choose your Core Provider: SecureW2 supports Google, Active Directory, Okta, LDAP, and other major Core Providers for user authentication during certificate enrollment. Specify your Core Provider here.
  2. PIN/PUK Requirements: Ensuring YubiKeys are not using default PINs and PUKs is extremely important. Configure your organization’s security policies regarding PIN/PUK here.
  3. Certificate Template: The SecureW2 PKI services empower organizations to generate custom certificates for Desktop Login, VPN, Wi-Fi, and more. Specify the application for which your certificate is intended here.
  4. Run the Wizard: After configuring the settings above, run the Wizard; it will configure everything required to set up your YubiKeys for certificates.

Configuring YubiKey Certificate Enrollment Settings

SecureW2 offers several Certificate Enrollment settings to deliver an easy, customizable end-user experience.

To configure these settings:

  1. Log in to the JoinNow Management Portal. 
  2. Navigate to Device Onboarding > Profiles.
  3. Click Edit on the profile you created in Getting Started.
  4. Scroll down to the Settings section and click Edit for Secure SSID.
  5. Expand the Client Certificate section and configure the following settings:
    1. Select the Use Smart Card for private key storage checkbox.
    2. Select the Enforce Smart Card checkbox.
    3. Select YubiKey from the Smart Card drop-down list.
    4. Select Enabled from the Require Touch drop-down list to require users to touch their YubiKeys.
    5. Optionally, configure PIN Management.
      1. Select Prevent Default PIN if you want to prevent YubiKeys with default PINs from enrolling for certificates.
      2. Minimum PIN – Length allows you to require a minimum PIN length.
      3. Select the Enforce PIN Complexity checkbox. It enforces the following PIN complexity conditions. Contains characters from the following categories:
        1. English uppercase characters (A through Z).
        2. English lowercase characters (a through z).
        3. Base 10 digits (0 through 9).
    6. Optionally, configure PUK Management.
      1. PUK Policy:
        1. Select Disable PUK to prompt only for resetting the YubiKey PIN.
    7. Click Update.
  6. Click Update.

Key Attestation Settings

SecureW2 enables YubiKeys to perform Key Attestation, attesting that the private key was generated on the YubiKey itself. This allows administrators to create high security clearance access policies specifically for YubiKeys.

YubiKeys come with an attestation certificate signed by the standard Yubico PIV CA by default. Some YubiKeys, when ordered in large custom batches, come with attestation certificates issued by a custom Root CA. If your YubiKeys have a custom attestation Root CA, you can also upload that here.

  1. Navigate to Integration Hub > Key Attestation Platforms.
  2. Click Add.
  3. In the Name field, enter the name of the key attestation platform.
  4. From the Type drop-down list, select YubiKey.
  5. Click Save.
  6. Select the Configuration tab. To upload your custom Key Attestation Root CA:
    1. Select the Enable Certificate Chain Validation checkbox.
    2. Select Choose File.
    3. Upload your CA. Allowed certificate file extensions are .cer, .crt, and .pem.
    4. Click Upload.
  7. Click Update
  8. Now, your Key Attestation Provider will be a configurable setting when creating Device Policies.

Generate the Onboarding Page for YubiKey Self-Enrollment

After the Getting Started Wizard has finished, a landing page will be generated. This is where you will instruct your end users to navigate so they can self-service their YubiKeys for certificates.

Every aspect of this page is completely customizable. Contact us for more information.

To get your landing page:

  1. Navigate to Device Onboarding > Profiles and click View. You are redirected to the JoinNow Landing Page, which automatically detects the device operating system and deploys the appropriate client to configure the YubiKey.
  2. Copy this URL and instruct end-users to navigate to the page.

There are many other features you can configure in SecureW2, but the steps above outline the minimum setup required to start configuring YubiKeys for Certificates.

YubiKey Certificate Enrollment End User Flow

The following steps outline how the end-users can self-enroll themselves for unique certificates for their YubiKeys, using a macOS or a Windows device.

macOS

  1. Download the YubiKey Manager from https://www.yubico.com/products/servicessoftware/download/yubikey-manager.
  2. After you download and install the YubiKey Manager, reboot your computer.
  3. Open YubiKey Manager, and then insert your YubiKey.
  4. Go to the JoinNow MultiOS landing page.
  5. Click JoinNow and the JoinNow client will download.
  6. Click the SecureW2 JoinNow app and click Open in the window that appears and the JoinNow client will begin configuration.

Enter or Reset PIN/PUK

Ensuring YubiKeys are not using the default PIN and PUKs is extremely important. The JoinNow client can enforce any PIN/PUK complexity rules, detect whether the user is using a default PIN/PUK, and prevent certificate enrollment until the user has configured a secure, unique PIN/PUK.

NOTE: For security reasons, you can disable PUK reset YubiKeys from enrolling for certificates. To do this, navigate to step 5.e in the Configuring YubiKey Certificate Enrollment Settings section.

If you have forgotten or need to reset your PIN, follow these steps:

  1. In the SecureW2 client, click Forgot PIN?
  2. You are prompted to Use my (default) PUK or Reset your YubiKey.
    1. If you choose to use my (default) PUK:
      1. Enter your PUK.
      2. Upon successful authentication, a new screen appears. This screen notifies you that resetting your YubiKey will erase all existing data stored on it.
      3. Enter your new PIN and PUK, and then click Next. A screen confirming you have set a new PIN and PUK appears.
      4. Certificate enrollment resumes per the instructions in the next section.
    2. If you choose Reset your YubiKey:
      1. A new screen appears. This screen warns you that resetting your YubiKey will erase all existing information stored on it.
      2. Enter your new PIN and PUK, and then click Next.
      3. A screen appears confirming you have set a new PIN and PUK.
      4. Certificate enrollment resumes per the instructions in the next section.

NOTE: If you enter your default PIN/PUK, you will be prompted to reset your YubiKey.

Certificate Enrollment and Installation

After the client has ensured the YubiKey has a secure PIN, users can begin the certificate enrollment and installation process.

  1. Click Next to open the login page in a new tab. This login page can be configured for use with any LDAP (Active Directory) or SAML (Google Apps, Okta, OneLogin, and other major vendors) Core Provider.
  2. Enter your organization’s credentials. After the credentials are validated, you are returned to the JoinNow client.
  3. Enter your device credentials to allow JoinNow to configure your device.
  4. The JoinNow client now enrolls and configures the YubiKey for a certificate. When it finishes, click Done.
  5. Open the YubiKey Manager and click Applications > PIV > Configure Certificates to verify the SecureW2 certificate has been successfully installed on your YubiKey.

Desktop Logon

Not only are YubiKeys enrolled for certificates with SecureW2, but they are also configured for certificate applications such as desktop logon. After running the client, users can immediately start using their YubiKey for desktop logon.

To unlock the keychain required for desktop login in macOS, a self-signed certificate must be configured in Slot 9d. The client automatically does this, as seen by opening the YubiKey Manager client.

Windows

  1. Click here to download the YubiKey Smartcard Mini Driver for Windows. After you download and install the driver, reboot your computer.
  2. Navigate to your organization’s JoinNow landing page, and click JoinNow to download the client.
  3. Open the downloaded .exe file to begin the configuration process.

Enter or Reset PIN/PUK

Ensuring YubiKeys are not using the default PIN and PUKs is extremely important. The JoinNow client can enforce any PIN/PUK complexity rules, detect whether the user is using a default PIN/PUK, and prevent certificate enrollment until the user has configured a secure, unique PIN/PUK.

Note: For security reasons, you can disable PUK reset YubiKeys from enrolling for certificates. To do this, navigate to step 4.e in the “Configuring YubiKey Certificate Enrollment Settings” section.

If you have forgotten or need to reset your PIN, follow these steps:

  1. In the SecureW2 client, click Setup YubiKey/Forgot PIN.
  2. You are prompted to Use PUK or Reset YubiKey.
    1. If you choose Use PUK:
      1. Enter your PUK.
      2. Upon successful authentication, a new screen appears prompting you to enter your new PIN and PUK.
      3. Enter your new PIN and PUK, and then click Next. A screen appears confirming you have set a new PIN and PUK.
      4. Certificate enrollment resumes per the instructions in the next section.
    2. If you choose Reset YubiKey
      1. A new screen appears. This screen warns you that resetting your YubiKey will erase all existing information stored on it.
      2. Enter your new PIN and PUK, and then click Next. A screen appears confirming you’ve set a new PIN and PUK.
      3. Certificate enrollment resumes per the instructions in the following section.

NOTE: If you enter your default PIN/PUK, you will be prompted to reset your YubiKey.

Certificate Enrollment and Installation

After the client has ensured the YubiKey has a secure PIN, users can begin the certificate enrollment and installation process.

  1. Click Next to open a login page in a new tab. This login page can be configured for use with any LDAP (Active Directory) or SAML (Google Apps, Okta, OneLogin, and other major vendors) Core Provider.
  2. Enter your organization’s credentials. Once the credentials are validated, you are returned to the JoinNow client.
  3. The JoinNow client now enrolls and configures the YubiKey for a certificate. When it indicates you have joined the network, click Done.
  4. Open the YubiKey Manager and click Applications > PIV > Configure Certificates to verify the SecureW2 certificate has been successfully installed on your YubiKey.

Interested in receiving pricing information regarding our Security Key Solutions?

 
More Yubico Explainers
Reseller or MSP? Join our Partner Program