Introduction

The YubiKey Manager CLI tool ykman can be used to configure all aspects of the YubiKey. This manual covers the options for each command as well as examples. Some operating systems such as Windows may not have the ykman in the environment variables please navigate to  C:\Program Files\Yubico\Yubikey Manager\ to find the ykman for Windows.The YubiKey Manager CLI tool ykman can be used to configure all aspects of the YubiKey. This manual covers the options for each command as well as examples.

Commands

ykman

Usage:

 ykman [OPTIONS] COMMAND [ARGS]...

Description:

Configure your YubiKey via the command line.

Examples:

List connected YubiKeys, only output serial number:

$ ykman list --serials

Show information about YubiKey with serial number 0123456:

$ ykman --device 0123456 info

Options:

-v, --version
-d, --device SERIAL
-l, --log-level [DEBUG|INFO|WARNING|ERROR|CRITICAL]
Enable logging at given verbosity level.
--log-file FILE                 Write logs to the given FILE instead of
standard error; ignored unless --log-level
is also set.
-r, --reader NAME               Use an external smart card reader. Conflicts
with --device and list.
-h, --help                      Show this message and exit.

ykman config

Usage:

 ykman config [OPTIONS] COMMAND [ARGS]...

Description:

Enable/Disable applications.

The applications may be enabled and disabled independently over different

interfaces (USB and NFC). The configuration may also be protected by a

lock code.

Examples:

Disable PIV over the NFC interface:

$ ykman config nfc --disable PIV

Enable all applications over USB:

$ ykman config usb --enable-all

Generate and set a random application lock code:

$ ykman config set-lock-code --generate

Options:

-h, --help  Show this message and exit.

ykman config nfc

Usage:

 ykman config nfc [OPTIONS]

Description:

Enable or disable applications over NFC.

Options:

-f, --force                     Confirm the action without prompting.
-e, --enable [OTP|U2F|OPGP|PIV|OATH|FIDO2]
Enable applications.
-d, --disable [OTP|U2F|OPGP|PIV|OATH|FIDO2]
Disable applications.
-a, --enable-all                Enable all applications.
-D, --disable-all               Disable all applications
-l, --list                      List enabled applications
-L, --lock-code HEX             Current application configuration lock code.
-h, --help                      Show this message and exit.

ykman config set-lock-code

Usage:

 ykman config set-lock-code [OPTIONS]

Description:

Set or change the configuration lock code.

A lock code may be used to protect the application configuration. The lock

code must be a 32 characters (16 bytes) hex value.

Options:

-f, --force              Confirm the action without prompting.
-l, --lock-code HEX      Current lock code.
-n, --new-lock-code HEX  New lock code. Conflicts with --generate.
-c, --clear              Clear the lock code.
-g, --generate           Generate a random lock code. Conflicts with --new-
lock-code.
-h, --help               Show this message and exit.

ykman config usb

Usage:

 ykman config usb [OPTIONS]

Description:

Enable or disable applications over USB.

Options:

-f, --force                     Confirm the action without prompting.
-e, --enable [OTP|U2F|OPGP|PIV|OATH|FIDO2]
Enable applications.
-d, --disable [OTP|U2F|OPGP|PIV|OATH|FIDO2]
Disable applications.
-l, --list                      List enabled applications.
-a, --enable-all                Enable all applications.
-L, --lock-code HEX             Current application configuration lock code.
--touch-eject                   When set, the button toggles the state of
the smartcard between ejected and inserted.
(CCID only).
--no-touch-eject                Disable touch eject (CCID only).
--autoeject-timeout SECONDS     When set, the smartcard will automatically
eject after the given time. Implies --touch-
eject.
--chalresp-timeout SECONDS      Sets the timeout when waiting for touch for
challenge-response in the OTP application.
-h, --help                      Show this message and exit.

ykman fido

Usage:

 ykman fido [OPTIONS] COMMAND [ARGS]...

Description:

Manage FIDO applications.

Examples:

Reset the FIDO (FIDO2 and U2F) applications:

$ ykman fido reset

Change the FIDO2 PIN from 123456 to 654321:

$ ykman fido set-pin --pin 123456 --new-pin 654321

Options:

-h, --help  Show this message and exit.

ykman fido delete

Usage:

 ykman fido delete [OPTIONS] QUERY

Description:

Delete a resident credential.

Options:

-P, --pin TEXT  PIN code.
-f, --force     Confirm deletion without prompting
-h, --help      Show this message and exit.

Examples:

ykman fido info

Usage:

 ykman fido info [OPTIONS]

Description:

Display status of FIDO2 application.

Options:

-h, --help  Show this message and exit.

Examples:

ykman fido list

Usage:

 ykman fido list [OPTIONS]

Description:

List resident credentials.

Options:

-P, --pin TEXT  PIN code.
-h, --help      Show this message and exit.

Examples:

ykman fido reset

Usage:

 ykman fido reset [OPTIONS]

Description:

Reset all FIDO applications.

This action will wipe all FIDO credentials, including FIDO U2F

credentials, on the YubiKey and remove the PIN code.

The reset must be triggered immediately after the YubiKey is inserted, and

requires a touch on the YubiKey.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman fido set-pin

Usage:

 ykman fido set-pin [OPTIONS]

Description:

Set or change the PIN code.

The FIDO2 PIN must be at least 4 characters long, and supports any type of

alphanumeric characters.

On YubiKey FIPS, a PIN can be set for FIDO U2F. That PIN must be at least

6 characters long.

Options:

-P, --pin TEXT      Current PIN code.
-n, --new-pin TEXT  A new PIN.
-u, --u2f           Set FIDO U2F PIN instead of FIDO2 PIN.
-h, --help          Show this message and exit.

Examples:

ykman fido unlock

Usage:

 ykman fido unlock [OPTIONS]

Description:

Verify U2F PIN for YubiKey FIPS.

Unlock the YubiKey FIPS and allow U2F registration.

Options:

-P, --pin TEXT  Current PIN code.
-h, --help      Show this message and exit.

Examples:

ykman info

Usage:

 ykman info [OPTIONS]

Description:

Show general information.

Displays information about the attached YubiKey such as serial number,

firmware version, applications, etc.

Options:

-c, --check-fips  Check if YubiKey is in FIPS Approved mode.
-h, --help        Show this message and exit.

ykman list

Usage:

 ykman list [OPTIONS]

Description:

List connected YubiKeys.

Options:

-s, --serials  Output only serial numbers, one per line (devices without
serial will be omitted).
-r, --readers  List available smart card readers.
-h, --help     Show this message and exit.

ykman mode

Usage:

 ykman mode [OPTIONS] [MODE]

Description:

Manage connection modes (USB Interfaces).

Get the current connection mode of the YubiKey, or set it to MODE.

MODE can be a string, such as "OTP+FIDO+CCID", or a shortened form:

"o+f+c". It can also be a mode number.

Examples:

Set the OTP and FIDO mode:

$ ykman mode OTP+FIDO

Set the CCID only mode and use touch to eject the smart card:

$ ykman mode CCID --touch-eject

Options:

--touch-eject                When set, the button toggles the state of the
smartcard between ejected and inserted (CCID
mode only).
--autoeject-timeout SECONDS  When set, the smartcard will automatically
eject after the given time. Implies --touch-
eject (CCID mode only).
--chalresp-timeout SECONDS   Sets the timeout when waiting for touch for
challenge response.
-f, --force                  Confirm the action without prompting.
-h, --help                   Show this message and exit.

ykman oath

Usage:

 ykman oath [OPTIONS] COMMAND [ARGS]...

Description:

Manage OATH Application.

Examples:

Generate codes for credentials starting with 'yubi':

$ ykman oath code yubi

Add a touch credential with the secret key f5up4ub3dw and the name yubico:

$ ykman oath add yubico f5up4ub3dw --touch

Set a password for the OATH application:

$ ykman oath set-password

Options:

-p, --password TEXT  Provide a password to unlock the YubiKey.
-h, --help           Show this message and exit.

ykman oath add

Usage:

 ykman oath add [OPTIONS] NAME [SECRET]

Description:

Add a new credential.

This will add a new credential to your YubiKey.

Options:

-o, --oath-type [HOTP|TOTP]     Time-based (TOTP) or counter-based (HOTP)
credential.  [default: TOTP]
-d, --digits [6|7|8]            Number of digits in generated code.
[default: 6]
-a, --algorithm [SHA1|SHA256|SHA512]
Algorithm to use for code generation.
[default: SHA1]
-c, --counter INTEGER           Initial counter value for HOTP credentials.
-i, --issuer TEXT               Issuer of the credential.
-p, --period INTEGER            Number of seconds a TOTP code is valid.
[default: 30]
-t, --touch                     Require touch on YubiKey to generate code.
-f, --force                     Confirm the action without prompting.
-h, --help                      Show this message and exit.

Examples:

ykman oath code

Usage:

 ykman oath code [OPTIONS] [QUERY]

Description:

Generate codes.

Generate codes from credentials stored on your YubiKey. Provide a query

string to match one or more specific credentials. Touch and HOTP

credentials require a single match to be triggered.

Options:

-H, --show-hidden  Include hidden credentials.
-s, --single       Ensure only a single match, and output only the code.
-h, --help         Show this message and exit.

Examples:

ykman oath delete

Usage:

 ykman oath delete [OPTIONS] QUERY

Description:

Delete a credential.

Delete a credential from your YubiKey. Provide a query string to match the

credential to delete.

Options:

-f, --force  Confirm deletion without prompting
-h, --help   Show this message and exit.

Examples:

ykman oath info

Usage:

 ykman oath info [OPTIONS]

Description:

Display status of OATH application.

Options:

-h, --help  Show this message and exit.

Examples:

ykman oath list

Usage:

 ykman oath list [OPTIONS]

Description:

List all credentials.

List all credentials stored on your YubiKey.

Options:

-H, --show-hidden  Include hidden credentials.
-o, --oath-type    Display the OATH type.
-p, --period       Display the period.
-h, --help         Show this message and exit.

Examples:

ykman oath remember-password

Usage:

 ykman oath remember-password [OPTIONS]

Description:

Manage local password storage.

Store your YubiKeys password on this computer to avoid having to enter it

on each use, or delete stored passwords.

Options:

-F, --forget     Forget a password.
-c, --clear-all  Remove all stored passwords from this computer.
-h, --help       Show this message and exit.

Examples:

ykman oath reset

Usage:

 ykman oath reset [OPTIONS]

Description:

Reset all OATH data.

This action will wipe all credentials and reset factory settings for the

OATH application on the YubiKey.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman oath set-password

Usage:

 ykman oath set-password [OPTIONS]

Description:

Password protect the OATH credentials.

Allows you to set a password that will be required to access the OATH

credentials stored on your YubiKey.

Options:

-c, --clear              Clear the current password.
-n, --new-password TEXT  Provide a new password as an argument.
-r, --remember           Remember the new password on this machine.
-h, --help               Show this message and exit.

Examples:

ykman oath uri

Usage:

 ykman oath uri [OPTIONS] [URI]

Description:

Add a new credential from URI.

Use a URI to add a new credential to your YubiKey.

Options:

-t, --touch  Require touch on YubiKey to generate code.
-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman openpgp

Usage:

 ykman openpgp [OPTIONS] COMMAND [ARGS]...

Description:

Manage OpenPGP Application.

Examples:

Set the retries for PIN, Reset Code and Admin PIN to 10:

$ ykman openpgp set-retries 10 10 10

Require touch to use the authentication key:

$ ykman openpgp set-touch aut on

Options:

-h, --help  Show this message and exit.

ykman openpgp attest

Usage:

 ykman openpgp attest [OPTIONS] KEY CERTIFICATE

Description:

Generate an attestation certificate for a key.

Attestation is used to show that an asymmetric key was generated on the

YubiKey and therefore doesn't exist outside the device.

KEY Key slot to attest (sig, enc, aut).

CERTIFICATE File to write attestation certificate to. Use '-' to use stdout.

Options:

-P, --pin TEXT          PIN code.
-F, --format [PEM|DER]  Encoding format.  [default: PEM]
-h, --help              Show this message and exit.

Examples:

ykman openpgp delete-certificate

Usage:

 ykman openpgp delete-certificate [OPTIONS] KEY

Description:

Delete an OpenPGP certificate.

KEY Key slot to delete certificate from (sig, enc, aut, or att).

Options:

-a, --admin-pin TEXT  Admin PIN for OpenPGP.
-h, --help            Show this message and exit.

Examples:

ykman openpgp export-certificate

Usage:

 ykman openpgp export-certificate [OPTIONS] KEY CERTIFICATE

Description:

Export an OpenPGP certificate.

KEY Key slot to read from (sig, enc, aut, or att).

CERTIFICATE File to write certificate to. Use '-' to use stdout.

Options:

-F, --format [PEM|DER]  Encoding format.  [default: PEM]
-h, --help              Show this message and exit.

Examples:

ykman openpgp import-attestation-key

Usage:

 ykman openpgp import-attestation-key [OPTIONS] PRIVATE-KEY

Description:

Import a private attestation key.

Import a private key for OpenPGP attestation.

PRIVATE-KEY File containing the private key. Use '-' to use stdin.

Options:

-a, --admin-pin TEXT  Admin PIN for OpenPGP.
-h, --help            Show this message and exit.

Examples:

ykman openpgp import-certificate

Usage:

 ykman openpgp import-certificate [OPTIONS] KEY CERTIFICATE

Description:

Import an OpenPGP certificate.

KEY Key slot to import certificate to (sig, enc, aut, or att).

CERTIFICATE File containing the certificate. Use '-' to use stdin.

Options:

-a, --admin-pin TEXT  Admin PIN for OpenPGP.
-h, --help            Show this message and exit.

Examples:

ykman openpgp info

Usage:

 ykman openpgp info [OPTIONS]

Description:

Display status of OpenPGP application.

Options:

-h, --help  Show this message and exit.

Examples:

ykman openpgp reset

Usage:

 ykman openpgp reset [OPTIONS]

Description:

Reset OpenPGP application.

This action will wipe all OpenPGP data, and set all PINs to their default

values.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman openpgp set-pin-retries

Usage:

 ykman openpgp set-pin-retries [OPTIONS] PIN-RETRIES RESET-CODE-RETRIES

Description:

ADMIN-PIN-RETRIES

Set PIN, Reset Code and Admin PIN retries.

Options:

-a, --admin-pin TEXT  Admin PIN for OpenPGP.
-f, --force           Confirm the action without prompting.
-h, --help            Show this message and exit.

Examples:

ykman openpgp set-touch

Usage:

 ykman openpgp set-touch [OPTIONS] KEY POLICY

Description:

Set touch policy for OpenPGP keys.

KEY Key slot to set (sig, enc, aut or att).

POLICY Touch policy to set (on, off, fixed, cached or cached-fixed).

Options:

-a, --admin-pin TEXT  Admin PIN for OpenPGP.
-f, --force           Confirm the action without prompting.
-h, --help            Show this message and exit.

Examples:

ykman otp

Usage:

 ykman otp [OPTIONS] COMMAND [ARGS]...

Description:

Manage OTP Application.

The YubiKey provides two keyboard-based slots which can each be configured

with a credential. Several credential types are supported.

A slot configuration may be write-protected with an access code. This

prevents the configuration to be overwritten without the access code

provided. Mode switching the YubiKey is not possible when a slot is

configured with an access code.

Examples:

Swap the configurations between the two slots:

$ ykman otp swap

Program a random challenge-response credential to slot 2:

$ ykman otp chalresp --generate 2

Program a Yubico OTP credential to slot 1, using the serial as public id:

$ ykman otp yubiotp 1 --serial-public-id

Program a random 38 characters long static password to slot 2:

$ ykman otp static --generate 2 --length 38

Options:

--access-code HEX  A 6 byte access code. Set to empty to use a prompt for
input.
-h, --help         Show this message and exit.

ykman otp calculate

Usage:

 ykman otp calculate [OPTIONS] [1|2] [CHALLENGE]

Description:

Perform a challenge-response operation.

Send a challenge (in hex) to a YubiKey slot with a challenge-response

credential, and read the response. Supports output as a OATH-TOTP code.

Options:

-T, --totp          Generate a TOTP code, use the current time as challenge.
-d, --digits [6|8]  Number of digits in generated TOTP code (default is 6).
-h, --help          Show this message and exit.

Examples:

ykman otp chalresp

Usage:

 ykman otp chalresp [OPTIONS] [1|2] [KEY]

Description:

Program a challenge-response credential.

If KEY is not given, an interactive prompt will ask for it.

Options:

-t, --touch     Require touch on YubiKey to generate response.
-T, --totp      Use a base32 encoded key for TOTP credentials.
-g, --generate  Generate a random secret key. Conflicts with KEY argument.
-f, --force     Confirm the action without prompting.
-h, --help      Show this message and exit.

Examples:

ykman otp delete

Usage:

 ykman otp delete [OPTIONS] [1|2]

Description:

Deletes the configuration of a slot.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman otp hotp

Usage:

 ykman otp hotp [OPTIONS] [1|2] [KEY]

Description:

Program an HMAC-SHA1 OATH-HOTP credential.

Options:

-d, --digits [6|8]     Number of digits in generated code (default is 6).
-c, --counter INTEGER  Initial counter value.
--no-enter             Don't send an Enter keystroke after outputting the
code.
-f, --force            Confirm the action without prompting.
-h, --help             Show this message and exit.

Examples:

ykman otp info

Usage:

 ykman otp info [OPTIONS]

Description:

Display status of YubiKey Slots.

Options:

-h, --help  Show this message and exit.

Examples:

ykman otp ndef

Usage:

 ykman otp ndef [OPTIONS] [1|2]

Description:

Select slot configuration to use for NDEF.

The default prefix will be used if no prefix is specified.

Options:

-p, --prefix TEXT  Added before the NDEF payload. Typically a URI.
-h, --help         Show this message and exit.

Examples:

ykman otp settings

Usage:

 ykman otp settings [OPTIONS] [1|2]

Description:

Update the settings for a slot.

Change the settings for a slot without changing the stored secret. All

settings not specified will be written with default values.

Options:

-f, --force                Confirm the action without prompting.
-A, --new-access-code HEX  Set a new 6 byte access code for the slot. Set to
empty to use a prompt for input.
--delete-access-code       Remove access code from the slot.
--enter / --no-enter       Should send 'Enter' keystroke after slot output.
[default: True]
-p, --pacing [0|20|40|60]  Throttle output speed by adding a delay (in ms)
between characters emitted.  [default: 0]
--use-numeric-keypad       Use scancodes for numeric keypad when sending
digits. Helps with some keyboard layouts.
[default: False]
-h, --help                 Show this message and exit.

Examples:

ykman otp static

Usage:

 ykman otp static [OPTIONS] [1|2] [PASSWORD]

Description:

Configure a static password.

To avoid problems with different keyboard layouts, the following

characters are allowed by default: cbdefghijklnrtuv

Use the --keyboard-layout option to allow more characters based on

preferred keyboard layout.

Options:

-g, --generate                  Generate a random password.
-l, --length INTEGER RANGE      Length of generated password.
-k, --keyboard-layout [MODHEX|US|DE|NORMAN]
Keyboard layout to use for the static
password.  [default: MODHEX]
--no-enter                      Don't send an Enter keystroke after
outputting the password.
-f, --force                     Confirm the action without prompting.
-h, --help                      Show this message and exit.

Examples:

ykman otp swap

Usage:

 ykman otp swap [OPTIONS]

Description:

Swaps the two slot configurations.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman otp yubiotp

Usage:

 ykman otp yubiotp [OPTIONS] [1|2]

Description:

Program a Yubico OTP credential.

Options:

-P, --public-id MODHEX     Public identifier prefix.
-p, --private-id HEX       6 byte private identifier.
-k, --key HEX              16 byte secret key.
--no-enter                 Don't send an Enter keystroke after emitting the
OTP.
-S, --serial-public-id     Use YubiKey serial number as public ID. Conflicts
with --public-id.
-g, --generate-private-id  Generate a random private ID. Conflicts with
--private-id.
-G, --generate-key         Generate a random secret key. Conflicts with
--key.
-u, --upload               Upload credential to YubiCloud (opens in
browser). Conflicts with --force.
-f, --force                Confirm the action without prompting.
-h, --help                 Show this message and exit.

Examples:

ykman piv

Usage:

 ykman piv [OPTIONS] COMMAND [ARGS]...

Description:

Manage PIV Application.

Examples:

Generate an ECC P-256 private key and a self-signed certificate in

slot 9a:

$ ykman piv generate-key --algorithm ECCP256 9a pubkey.pem

$ ykman piv generate-certificate --subject "yubico" 9a pubkey.pem

Change the PIN from 123456 to 654321:

$ ykman piv change-pin --pin 123456 --new-pin 654321

Reset all PIV data and restore default settings:

$ ykman piv reset

Options:

-h, --help  Show this message and exit.

ykman piv attest

Usage:

 ykman piv attest [OPTIONS] SLOT CERTIFICATE

Description:

Generate an attestation certificate for a key.

Attestation is used to show that an asymmetric key was generated on the

YubiKey and therefore doesn't exist outside the device.

SLOT PIV slot with a private key to attest.

CERTIFICATE File to write attestation certificate to. Use '-' to use stdout.

Options:

-F, --format [PEM|DER]  Encoding format.  [default: PEM]
-h, --help              Show this message and exit.

Examples:

ykman piv change-management-key

Usage:

 ykman piv change-management-key [OPTIONS]

Description:

Change the management key.

Management functionality is guarded by a 24 byte management key. This key

is required for administrative tasks, such as generating key pairs. A

random key may be generated and stored on the YubiKey, protected by PIN.

Options:

-P, --pin TEXT                 PIN code.
-t, --touch                    Require touch on YubiKey when prompted for
management key.
-n, --new-management-key TEXT  A new management key.
-m, --management-key TEXT      Current management key.
-p, --protect                  Store new management key on your YubiKey,
protected by PIN. A random key will be used
if no key is provided.
-g, --generate                 Generate a random management key. Implied by
--protect unless --new-management-key is also
given. Conflicts with --new-management-key.
-f, --force                    Confirm the action without prompting.
-h, --help                     Show this message and exit.

Examples:

ykman piv change-pin

Usage:

 ykman piv change-pin [OPTIONS]

Description:

Change the PIN code.

The PIN must be between 6 and 8 characters long, and supports any type of

alphanumeric characters. For cross-platform compatibility, numeric digits

are recommended.

Options:

-P, --pin TEXT      Current PIN code.
-n, --new-pin TEXT  A new PIN.
-h, --help          Show this message and exit.

Examples:

ykman piv change-puk

Usage:

 ykman piv change-puk [OPTIONS]

Description:

Change the PUK code.

If the PIN is lost or blocked it can be reset using a PUK. The PUK must be

between 6 and 8 characters long, and supports any type of alphanumeric

characters.

Options:

-p, --puk TEXT      Current PUK code.
-n, --new-puk TEXT  A new PUK code.
-h, --help          Show this message and exit.

Examples:

ykman piv delete-certificate

Usage:

 ykman piv delete-certificate [OPTIONS] SLOT

Description:

Delete a certificate.

Delete a certificate from a slot on the YubiKey.

Options:

-m, --management-key TEXT  The management key.
-P, --pin TEXT             PIN code.
-h, --help                 Show this message and exit.

Examples:

ykman piv export-certificate

Usage:

 ykman piv export-certificate [OPTIONS] SLOT CERTIFICATE

Description:

Export a X.509 certificate.

Reads a certificate from one of the slots on the YubiKey.

SLOT PIV slot to read certificate from.

CERTIFICATE File to write certificate to. Use '-' to use stdout.

Options:

-F, --format [PEM|DER]  Encoding format.  [default: PEM]
-h, --help              Show this message and exit.

Examples:

ykman piv generate-certificate

Usage:

 ykman piv generate-certificate [OPTIONS] SLOT PUBLIC-KEY

Description:

Generate a self-signed X.509 certificate.

A self-signed certificate is generated and written to one of the slots on

the YubiKey. A private key need to exist in the slot.

SLOT PIV slot where private key is stored.

PUBLIC-KEY File containing a public key. Use '-' to use stdin.

Options:

-m, --management-key TEXT  The management key.
-P, --pin TEXT             PIN code.
-s, --subject TEXT         Subject common name (CN) for the certificate.
[required]
-d, --valid-days INTEGER   Number of days until the certificate expires.
[default: 365]
-h, --help                 Show this message and exit.

Examples:

ykman piv generate-csr

Usage:

 ykman piv generate-csr [OPTIONS] SLOT PUBLIC-KEY CSR

Description:

Generate a Certificate Signing Request (CSR).

A private key need to exist in the slot.

SLOT PIV slot where the private key is stored.

PUBLIC-KEY File containing a public key. Use '-' to use stdin.

CSR File to write CSR to. Use '-' to use stdout.

Options:

-P, --pin TEXT      PIN code.
-s, --subject TEXT  Subject common name (CN) for the requested certificate.
[required]
-h, --help          Show this message and exit.

Examples:

ykman piv generate-key

Usage:

 ykman piv generate-key [OPTIONS] SLOT PUBLIC-KEY

Description:

Generate an asymmetric key pair.

The private key is generated on the YubiKey, and written to one of the

slots.

SLOT PIV slot where private key should be stored.

PUBLIC-KEY File containing the generated public key. Use '-' to use stdout.

Options:

-m, --management-key TEXT       The management key.
-P, --pin TEXT                  PIN code.
-a, --algorithm [TDES|RSA1024|RSA2048|ECCP256|ECCP384]
Algorithm to use in key generation.
[default: RSA2048]
-F, --format [PEM|DER]          Encoding format.  [default: PEM]
--pin-policy [DEFAULT|NEVER|ONCE|ALWAYS]
PIN policy for slot.
--touch-policy [DEFAULT|NEVER|ALWAYS|CACHED]
Touch policy for slot.
-h, --help                      Show this message and exit.

Examples:

ykman piv import-certificate

Usage:

 ykman piv import-certificate [OPTIONS] SLOT CERTIFICATE

Description:

Import a X.509 certificate.

Write a certificate to one of the slots on the YubiKey.

SLOT PIV slot to import the certificate to.

CERTIFICATE File containing the certificate. Use '-' to use stdin.

Options:

-m, --management-key TEXT  The management key.
-P, --pin TEXT             PIN code.
-p, --password TEXT        A password may be needed to decrypt the data.
-v, --verify               Verify that the certificate matches the private
key in the slot.
-h, --help                 Show this message and exit.

Examples:

ykman piv import-key

Usage:

 ykman piv import-key [OPTIONS] SLOT PRIVATE-KEY

Description:

Import a private key.

Write a private key to one of the slots on the YubiKey.

SLOT PIV slot to import the private key to.

PRIVATE-KEY File containing the private key. Use '-' to use stdin.

Options:

-P, --pin TEXT                  PIN code.
-m, --management-key TEXT       The management key.
--pin-policy [DEFAULT|NEVER|ONCE|ALWAYS]
PIN policy for slot.
--touch-policy [DEFAULT|NEVER|ALWAYS|CACHED]
Touch policy for slot.
-p, --password TEXT             Password used to decrypt the private key.
-h, --help                      Show this message and exit.

Examples:

ykman piv info

Usage:

 ykman piv info [OPTIONS]

Description:

Display status of PIV application.

Options:

-h, --help  Show this message and exit.

Examples:

ykman piv read-object

Usage:

 ykman piv read-object [OPTIONS] OBJECT-ID

Description:

Read arbitrary PIV object.

Read PIV object by providing the object id.

OBJECT-ID Id of PIV object in HEX.

Options:

-P, --pin TEXT  PIN code.
-h, --help      Show this message and exit.

Examples:

ykman piv reset

Usage:

 ykman piv reset [OPTIONS]

Description:

Reset all PIV data.

This action will wipe all data and restore factory settings for the PIV

application on your YubiKey.

Options:

-f, --force  Confirm the action without prompting.
-h, --help   Show this message and exit.

Examples:

ykman piv set-ccc

Usage:

 ykman piv set-ccc [OPTIONS]

Description:

Generate and set a CCC on the YubiKey.

Options:

-P, --pin TEXT             PIN code.
-m, --management-key TEXT  The management key.
-h, --help                 Show this message and exit.

Examples:

ykman piv set-chuid

Usage:

 ykman piv set-chuid [OPTIONS]

Description:

Generate and set a CHUID on the YubiKey.

Options:

-P, --pin TEXT             PIN code.
-m, --management-key TEXT  The management key.
-h, --help                 Show this message and exit.

Examples:

ykman piv set-pin-retries

Usage:

 ykman piv set-pin-retries [OPTIONS] PIN-RETRIES PUK-RETRIES

Description:

Set the number of PIN and PUK retries. NOTE: This will reset the PIN and

PUK to their factory defaults.

Options:

-m, --management-key TEXT  The management key.
-P, --pin TEXT             PIN code.
-f, --force                Confirm the action without prompting.
-h, --help                 Show this message and exit.

Examples:

ykman piv unblock-pin

Usage:

 ykman piv unblock-pin [OPTIONS]

Description:

Unblock the PIN.

Reset the PIN using the PUK code.

Options:

-p, --puk TEXT
-n, --new-pin NEW-PIN
-h, --help             Show this message and exit.

Examples:

ykman piv write-object

Usage:

 ykman piv write-object [OPTIONS] OBJECT-ID DATA

Description:

Write an arbitrary PIV object.

Write a PIV object by providing the object id. Yubico writable PIV objects

are available in the range 5f0000 - 5fffff.

OBJECT-ID Id of PIV object in HEX.

DATA File containing the data to be written. Use '-' to use stdin.

Options:

-P, --pin TEXT             PIN code.
-m, --management-key TEXT  The management key.
-h, --help                 Show this message and exit.

Examples: