YubiKey PIV Setup

This guide walks through generating a signing key on your YubiKey using its PIV interface, for use as a key storage option with the BD Approver app on Windows desktop.

📘

Your private key never leaves the device

The private key is generated on the YubiKey and never leaves the device. Only the public key is temporarily written to disk during setup and can be safely deleted afterwards.

Prerequisites

• A YubiKey 5 series (USB-A or USB-C).
• Windows 10 or later, or macOS.

Step 1: Install YubiKey Manager

Required to interact with your YubiKey from the command line.

Windows, Option A (Winget, recommended)

winget install Yubico.YubikeyManager

Windows, Option B (direct download)

Download and run the YubiKey Manager installer from the Yubico website.

macOS

brew install ykman

Once installed, confirm ykman is available in your terminal:

ykman --version

Step 2: Generate an EC P-256 key in slot 9a

Creates a private key on the YubiKey and temporarily exports the public key to a local file so it can be used in the next step.

Windows

ykman piv keys generate --algorithm ECCP256 9a %TEMP%\pubkey.pem

macOS

ykman piv keys generate --algorithm ECCP256 9a /tmp/pubkey.pem

Step 3: Generate a self-signed certificate

Loads a certificate into slot 9a so the app can read and verify the public key.

Windows

ykman piv certificates generate --subject "CN=BD Approver" 9a %TEMP%\pubkey.pem

macOS

ykman piv certificates generate --subject "CN=BD Approver" 9a /tmp/pubkey.pem

Step 4: Verify slot contents

Confirm slot 9a shows AUTHENTICATION under certificates before continuing.

ykman piv info

Step 5: Clean up the temporary public key file

The temporary public key file is no longer needed and can be deleted.

Windows

del %TEMP%\pubkey.pem

macOS

rm /tmp/pubkey.pem

Step 6: Return to the app

Insert your YubiKey and return to the onboarding screen. The app will detect and read your public key from slot 9a automatically.