How to Secure Your Code Signing Credentials with YubiKey?
Tags: tutorial, cybersecurity, devops, programming
Published: 2023-06-06 15:23:51

![code-signing-credentials-yubikey](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yo4y9nj5lwe3gmyglnq6.jpg)
The integration of Hardware Security Modules (HSMs) with the code signing process has led to YubiKey, a popular HSM token trending in the market and widely accepted by many business organizations and CAs around the globe. Also, as per the [previous post](https://dev.to/annashipman/how-to-install-code-signing-certificate-in-yubikey-37ca), we all have a clear understanding of what YubiKey HSM is and the most easy process of installing code signing certificates on YubiKey. 

Now, let us discover how to securely store your Code Signing Certificate Credentials in the YubiKey HSM using an easy step-by-step process;

## Step 1
Open "pivman.exe" which is the YubiKey's **Personal Identity Verification (PIV)** managing software as per below image.

![YubiKey-Step-1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yuqqo35apsyb7dcsjflk.png)

## Step 2
Now, you need to plug in the **YubiKey** and if required then you will be prompted to generate a Personal Identification Number (PIN) for your device. 

![YubiKey-Step-2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wfylw213qgtw48xkjlv8.png)

## Step 3
On the PIN setup screen, for authentication of PIN and unlocking YubiKey device, select the **"USE PIN as KEY"** under the **Management Key** option as per the above image.

## Step 4
For code signing on Windows based system you can overlook the PIN recommendation for cross-platform compatibility. This is so because the PIN is usually of just eight characters and Windows doesn't have issues with a PIN that includes extended alphanumeric characters.

Moreover, please Note that YubiKey has **Three Attempts** to enter correct PIN or else would get locked erasing all data stored in it for data security and then it can only be accessed using **Reset Option.**

## Step 5
Once the PIN is successfully set, you will be navigated to a PIV Manager Screen where you need to click the **Certificates Tab**

![YubiKey-Step-5](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ofxvjuklvslw821o3jdo.png)

## Step 6
In this step, you need to select the Digital Signature section in the Certificates screen which indicates the certificate type required for code signing.

![YubiKey-Step-6](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k9ugkhwurov7wc3y9t2z.png)

## Step 7
In this step, click on **Import From file** and select your **.p12 Code** for signing the credential file by which under the .p12 coded file you are required to enter the password set for the private key (Not the YubiKey PIN)

## Step 8
Once the Step 7 of **Importing Certificate** is successful, you will get a popup message displaying same along with instruction to **Unplug and Re-insert** your YubiKey as per below image.

![YubiKey-Step-8](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1a203bhqoo7jqqjaaadi.png)

## Step 9
This is the last step whereby you just need to pug in back the YubiKey and return back to the Digital Signature option certificate in the PIV Manager tab. 

Here your installed code signing certificate details and  credentials will be displayed which can be used for code signing process.

![YubiKey-Step-9](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cx0il3fh3z9okhsojc6z.png)

## Conclusion
To sum up, following these steps will enable you to securely store and manage your installed [code signing certificate](https://signmycode.com/code-signing-certificates) credentials on your YubiKey hardware device.