As PIV is typically issued by system administrators and used by regular users, please review the documentation to understand the following content before proceeding.
It is recommended to use yubico-piv-tool for related operations.
If the key and certificate are in two separate files, they need to be imported separately.
Importing the private key:
yubico-piv-tool -r canokey -a import-key -s 9a -i private-key.pem
Importing the certificate:
yubico-piv-tool -r canokey -a import-certificate -s 9a -i certificate.pem
Here, -s 9a indicates using the 9A key slot, which can be changed as needed.
To import a PKCS#12 file (.p12 or .pfx) containing both the private key and certificate, execute:
yubico-piv-tool -r canokey -a import-key -a import-certificate -K PKCS12 -s 9a -i certificate.p12
Generate a new private key and self-sign it:
yubico-piv-tool -r canokey -a generate -s 9a -A RSA2048 -o public-key.pem
yubico-piv-tool -r canokey -a verify-pin -a selfsign -s 9a -S "/CN=Test Certificate" -i public-key.pem -o certificate.pem
yubico-piv-tool -r canokey -a import-certificate -s 9a -i certificate.pem
Since Windows caches certificate information based on CHUID, you need to update the CHUID after certificate import on Windows:
yubico-piv-tool -r canokey -a set-chuid