# 4. Certificates

{% hint style="info" %}
This section explains the basics of how these features work, in-depth tutorials will be provided elsewhere for doing things like setting up Bitlocker, SSH, etc.
{% endhint %}

The main job of the PIV module on your Yubikey is to store PIV certificates. These certificates will give you access to do certain things.

## <mark style="color:red;">❊ Slots</mark>

In Yubikey Manager, select <mark style="color:red;">**Applications**</mark> and then <mark style="color:red;">**PIV**</mark>:

<figure><img src="https://4238369593-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqj0swE9RiXnBGKcxMY3V%2Fuploads%2FxfZotkxSYfMwF3cRDLIY%2Fanim_piv.gif?alt=media&#x26;token=645b71fd-e07f-4b8d-a6c9-3c73c075ab4d" alt=""><figcaption></figcaption></figure>

You will be shown an interface which gives you access to 4 main slots:

<figure><img src="https://4238369593-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqj0swE9RiXnBGKcxMY3V%2Fuploads%2FyihvgLrsHwFRiEns56fB%2Fpiv_certs.png?alt=media&#x26;token=c7c5aeae-5f75-45c7-8ac8-dbb1f08c7d46" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="251.33333333333331">Name</th><th width="74">Slot</th><th>Description</th></tr></thead><tbody><tr><td><a href="../slots/9a"><strong>Authentication</strong></a></td><td><a href="../slots/9a">9A</a></td><td>This certificate and its associated private key is used to authenticate the card and the cardholder. This slot is used for things like system login, SSH authentication, etc.</td></tr><tr><td><a href="../slots/9c"><strong>Digital Signature</strong></a></td><td><a href="../slots/9c"><strong>9C</strong></a></td><td>This certificate and its associated private key is used for digital signatures for the purpose of document signing, or signing files and executables</td></tr><tr><td><a href="../slots/9d"><strong>Key Management</strong></a></td><td><a href="../slots/9d">9D</a></td><td>This certificate and its associated private key is used for encryption for the purpose of confidentiality. This slot is used for things like encrypting e-mails or files.</td></tr><tr><td><a href="../slots/9e"><strong>Card Authentication</strong></a></td><td><a href="../slots/9e">9E</a></td><td>This certificate and its associated private key is used to support additional physical access applications, such as providing physical access to buildings via PIV-enabled door locks. It is also the slot used for Bitlocker encryption.</td></tr></tbody></table>

Each slot you click on gives you the same interface, with buttons to **Generate**, **Import**, **Export**, and **Delete**.

## <mark style="color:red;">❊ Generate</mark>

Each slot of the Yubikey's PIV module stores a certificate.&#x20;

A <mark style="color:red;">**certificate**</mark> has two parts, the <mark style="color:green;">**certificate**</mark> itself, and a <mark style="color:green;">**private / public keypair**</mark>.

The certificate contains the public key and additional information such as issuer, what the certificate is supposed to be used for, and other types of metadata.

The private key stays on your Yubikey.

The unique security feature about the Yubikey is that if you generate a certificate on the Yubikey using the **Generate** button, the private keys CANNOT be exported. Only the Yubikey you generated the keys on will have the private key associated to that certificate.

The <mark style="color:red;">**Generate**</mark> button does just that; it generates a new x509 certificate on your Yubikey for the slot you have selected. You can then select **Export**, and save the certificate somewhere on your computer in .pem or .crt format.

If you wish to generate your private / public keypair and actually have a copy of the private key that you can transfer between multiple Yubikeys, then you must generate it on the computer.&#x20;

A few programs that can be used to generate the private / public keypair with the ability to export the private key:

<table><thead><tr><th width="226"></th><th></th></tr></thead><tbody><tr><td><mark style="color:red;"><strong>XCA</strong></mark></td><td><a href="https://hohnstaedt.de/xca/index.php/download">https://hohnstaedt.de/xca/index.php/download</a></td></tr><tr><td><mark style="color:red;"><strong>OpenSSL</strong></mark></td><td><a href="https://www.openssl.org/source/">https://www.openssl.org/source/</a></td></tr></tbody></table>

**To summarize:**

If you generate the keypair on the Yubikey, <mark style="color:red;">**you will be unable**</mark> to export your private key.

If you generate the keypair using a program listed above, <mark style="color:green;">**you will be able**</mark> to export your private key and import it throughout multiple Yubikeys.

There will be tutorials in this guide on how to do things specifically. This is just a generalized explanation of how things work.

## <mark style="color:red;">❊ Import</mark>

The import button allows you to import an already created certificate + keypair.

You can import files in the formats: .pem, .der, .pfx, .p12, .key, .crt

## <mark style="color:red;">❊ Export</mark>

The export button allows you to export an already generated certificate + public key that is on the Yubikey.

You can export to the formats: .pem,  .crt

## <mark style="color:red;">❊ Delete</mark>

The delete button does what you think it does. It deletes the certificate from a Yubikey PIV slot. It will be no more. You will have to generate a new certificate, or import your certificate back onto your Yubikey if you have a backup.