Source
r/sysadmin•
brainstomp

Yubikey & OnPrem AD - is it working for you?

I'm testing out a deployment of Yubikeys as 2FA in a test environment following the instructions from Yubico's documentation (https://support.yubico.com/hc/en-us/articles/360013707820). I'm running into a brick wall at the step labeled "Setting up Windows Server for YubiKey PIV Authentication".

​

Has anyone here been successful at deploying yubikeys to your on prem AD without 3rd party software? If so, what documentation did you follow?

Yes, I know I can use 3rd party software from many vendors to do this. I'm trying to sort out the process to do it without 3rd party software as the Yubikey is able to act as a smartcard for AD.

Posted Jan 24, 2022, 3:58 PM UTC

322
sarosanex-msp now bofh•

Yes, I use Yubikeys as Smart Cards (PIV/CAC) with my on-premises AD. I deployed it without any additional third-party software except for Yubikey's own SC Mini-Driver. I followed the same guide you linked in your post. The step you're stuck on is the main requirement for making this all work: a Certificate Authority, preferably a 2-tier PKI.

The whole system works great. I have several smart cards (certificates+keys) on my Yubikey: 1x Tier 0 (DA), 1x Tier 1, and 1x Tier 2. The Yubikey 5 can handle up to 15 smart cards. I created another Yubikey with another set of SCs (different certificates) that I keep at home for remote access and as a backup.

3
brainstompOPHave you tried turning it off and back on again?•

I'm obviously missing something in this process because even though the process of installing the certificate completes successfully on the yubikey the step that verifies the certificate is installed fails misserably:

At the step for verifying the key has the certificate we get:
C:\Users\Administrator\Downloads>certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
0: Yubico YubiKey OTP+FIDO+CCID 0
--- Reader: Yubico YubiKey OTP+FIDO+CCID 0
--- Status: SCARD_STATE_PRESENT | SCARD_STATE_INUSE
--- Status: The card is being shared by a process.
--- Card: YubiKey Smart Card
--- ATR:
3b fd 13 00 00 81 31 fe 15 80 73 c0 21 c0 57 59 ;.....1...s.!.WY
75 62 69 4b 65 79 40 ubiKey@
=======================================================
Analyzing card in reader: Yubico YubiKey OTP+FIDO+CCID 0
Missing stored keyset
Missing stored keyset
--------------===========================--------------
CertUtil: -SCInfo command FAILED: 0x80090016 (-2146893802 NTE_BAD_KEYSET)
CertUtil: Keyset does not exist

1
sarosanex-msp now bofh•

Did you load your CA's root certificate onto the Yubikey? A chain of trust may be required. Try the following:

certutil -scroots update "Root.crt"

Also, the Yubikey Mini-Driver needs to be installed on every computer you wish to authenticate on. On a remote server, you need to install the driver with INSTALL_LEGACY_NODE option:

msiexec /i YubiKey-Minidriver-4.1.1.210-x64.msi INSTALL_LEGACY_NODE=1 /quiet
2
brainstompOPHave you tried turning it off and back on again?•

Yes, installing the root certificate to the key works. It is reading it from the key that fails.
The Yubikey Driver is installed on the server in legacy mode and on the workstations on the domain.

When I install the certificate I get prompted for the key's PIN. I enter the PIN then I get this:
C:\Users\Administrator\Documents>certutil -scroots update "2022-01-24_ca_certificate.cer"
Element 0:
Serial Number: 1d2eb6e361a40c874753eead9bf9e195
Issuer: CN=brain-BSI-SRV-TEST-CA, DC=brain, DC=test
NotBefore: 6/30/2021 11:56 AM
NotAfter: 6/30/2051 12:06 PM
Subject: CN=brain-BSI-SRV-TEST-CA, DC=brain, DC=test
CA Version: V0.0
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): 10 b2 20 86 2a b1 ed a1 b5 b8 a2 35 0d 3e 11 b2 8f 2f e5 3c
Done.
CertUtil: -SCRoots command completed successfully.

When I go try to verify that the cert is in the key I get this:
C:\Users\Administrator\Documents>certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
0: Yubico YubiKey OTP+FIDO+CCID 0
--- Reader: Yubico YubiKey OTP+FIDO+CCID 0
--- Status: SCARD_STATE_PRESENT | SCARD_STATE_UNPOWERED
--- Status: The card is available for use.
--- Card: YubiKey Smart Card
--- ATR:
3b fd 13 00 00 81 31 fe 15 80 73 c0 21 c0 57 59 ;.....1...s.!.WY 75 62 69 4b 65 79 40 ubiKey@
=======================================================
Analyzing card in reader: Yubico YubiKey OTP+FIDO+CCID 0
Missing stored keyset
Missing stored keyset
--------------===========================--------------
CertUtil: -SCInfo command FAILED: 0x80090016 (-2146893802 NTE_BAD_KEYSET)
CertUtil: Keyset does not exist

1
sarosanex-msp now bofh•

How are you provisioning the Yubikey? Have you created the SC enrollment template in your Certificate Authority?

Quick overview of how enrollment works, starting with a blank Yubikey:

  1. Using the Yubikey Management app, set a PUK ("Pin Unlock Code") and nothing else. Leave the Management key as-is. If you don't set the PUK now, you can't change it afterwards without wiping the Yubikey.
  2. Install the Mini-Driver on all computers requiring SC authentication.
  3. Using Windows' built-in enrollment process, provision the Yubikey as a Smart Card. If you created the "Yubikey SC" template in your CA, Windows will pop-up a message on the client computer asking for enrollment. If you already did this step and want to redo it, you have to wipe the certificates in the user's certificate store.
  4. Load the root certificates using certutil -scupdate as previously mentioned.
  5. To change the PIN on the Yubikey, press CTRL+ALT+DEL and choose Change Password. Select the Yubikey SC. The default pin is "123456".

That's basically it for self-enrollment. Enrolling on behalf of other users has a few extra steps.

2
fr0zenaksenior peon•

Yes and No. Does it work? Sometimes. Multiple devices, multiple users, randomly stop accepting the PIN or cert. Use change password to change PIN, change successful. Still not accepting PIN or cert for auth.

Fine, clear out yubikey, get new cert. Install new cert on freshly-wiped Yubikey.
2 weeks later, same problem.

I basically gave up for the time being.

Note: This was intended to only (currently) be required for our privileged accounts.

2
sarosanex-msp now bofh•

Did you set a PUK code before provisioning?

1
fr0zenaksenior peon•

Yes. I would enter the correct PIN, but I was not getting successful auth. I cannot recall what the on-screen error message was.
I confirmed I was not locked out and I had the correct PIN by changing the PIN via change password, and could successfully change the PIN.

1