SSH Manager Pro

YubiKey setup

The app reads a key from PIV slot 9A but does not create one. Generating it needs the token's management key, which is a far more dangerous operation to get wrong — ykman does it properly.

1. Generate the key

Install the YubiKey Manager CLI, then:

ykman piv keys generate --algorithm ECCP256 9a public.pem

ykman piv certificates generate \
  --subject "CN=ssh" 9a public.pem

PIV stores a certificate alongside the key, and the app reads the public key from it — so the second command is required, not optional.

ECCP256 specifically. The app signs with P-256. An RSA or P-384 key in slot 9a will be read and then rejected with an explanation, rather than failing obscurely at connect time.

2. Change the default PIN

Factory defaults are PIN 123456 and PUK 12345678. Change both:

ykman piv access change-pin
ykman piv access change-puk

Three wrong PIN attempts block the token and only the PUK recovers it. Three wrong PUK attempts require a factory reset, destroying the key.

3. Enrol it in the app

  1. Add or edit a host and select SSH Key.
  2. Tap + Token, give it a name, then Tap to read.
  3. Hold the YubiKey flat against the back of the phone, near the NFC antenna — usually the upper third.

Reading needs no PIN: PIV protects signing, not reading a certificate. Enrolment is a single tap with nothing to type.

4. Authorise the key

The app shows the authorized_keys line. Add it to your server:

echo 'PASTE_THE_LINE_HERE' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

5. Connect

Tap the host. The app asks for the token's PIN, then for a tap. The PIN is held only for that connection and never stored.

Using it on more than one phone

Unlike a phone-bound key, this one belongs to the token. Enrol it on a second phone and the same key works — no re-authorising on the server. It is also included in encrypted backup, because the metadata is useful on a new device.

If it fails

Nothing happens on tap
Move the token slowly around the upper half of the phone's back; antenna placement varies. Check NFC is enabled.
"Nothing is stored in that slot"
The key or its certificate was not generated. Both commands in step 1 are needed.
"Not an EC key"
Slot 9a holds an RSA key. Regenerate with --algorithm ECCP256.
Wrong PIN
The app reports how many attempts remain. Stop and check before using the last one.