Poorman's HSM : A Secure Certificate Authority (CA) on a Yubikey

I have a project at work that required a secure method for standing up a CA in Air-gapped environments. Since security is of the utmost importance and budget is almost nonexistent, I had to get very creative. Due to paranoid security, step-ca was not an option, so I'm down to a Yubikey and OpenSSL. All previous tutorials I found on the internet for this stored Private Keys on USB drives, but that is not an option here. Secure air-gap environments don't allow USB storage devices.

So, I wondered why none of the tutorials just generated the Private Keys directly on the Yubikey and if it was possible. (Spoiler Alert: It is possible with some minor shenanigans).

Anyone interested in the process can view the procedure over on my GitHub located at https://github.com/DeltChar/CA-Yubikey . Let me know what you think and any suggestions you might have for me.

Also, let me know if you have any formatting suggestions. I'm good at technical things, but not technical writing.