Troubleshooting Common Issues in the YubiKey Configuration Utility

How to Configure Multiple YubiKeys with the YubiKey Configuration UtilityConfiguring multiple YubiKeys can dramatically improve the security and reliability of your two-factor authentication (2FA) setup. Whether you’re setting up backup keys, issuing keys to team members, or managing keys for different services, the YubiKey Configuration Utility (YKCU) provides a centralized, user-friendly way to program and manage YubiKeys. This guide walks through planning, preparing, and configuring multiple YubiKeys step‑by‑step, plus best practices, troubleshooting, and maintenance.

Why use multiple YubiKeys?

Redundancy: One lost or damaged YubiKey won’t lock you out if you have a configured backup.
Separation of roles: Use different keys for work vs. personal accounts, or for signing vs. authentication.
Shared management: Easily provision keys for team members with consistent policies.
Recovery and rotation: Replace or rotate keys without disrupting access.

Before you start: requirements and planning

What you need

A computer with the YubiKey Configuration Utility installed. YKCU is available for Windows, macOS, and Linux.
The YubiKeys you plan to configure (YubiKey 5 Series or later recommended for broader functionality).
Administrator access on the computer for installing drivers (if required).
A clear list of services/accounts and the intended use of each YubiKey (OTP, FIDO2/WebAuthn, PIV, OpenPGP, etc.).
Backup of any existing credentials or configurations (export/record where applicable).

Planning checklist

Decide how many keys per user (primary + backup is common).
Assign purposes per slot or per key (e.g., Key A = FIDO2 for web login, Key B = PIV for certificate-based access).
Label or otherwise identify each physical YubiKey (serial number, sticker, or write-protected tag).
Establish a secure storage location for backup YubiKeys.
Create a rotation and lifecycle policy (e.g., rotate keys every 2 years, revoke lost keys immediately).

Overview of YubiKey Configuration Utility features relevant to multiple-key setup

The YKCU provides a GUI and command-line options (ykman is the CLI tool; note: the YubiKey Manager—ykman—is commonly used in parallel). Features you’ll commonly use:

Viewing device info and serial numbers for inventory.
Configuring OTP slots (Slot 1, Slot 2) and programming static or challenge-response OTPs.
Enabling and configuring FIDO2/WebAuthn credentials.
Configuring PIV (smartcard) functions and importing certificates.
Managing OpenPGP keys on YubiKey.
Reset and factory reset options (use cautiously).
Exporting device information for inventory (note: private keys cannot be exported).

Step-by-step: Configure multiple YubiKeys using YubiKey Configuration Utility

Below are generalized steps. Some services (FIDO2/WebAuthn, PIV, OpenPGP) require actions both in YKCU/ykman and in the destination service’s account settings.

1) Inventory and identify each YubiKey

Plug in the first YubiKey.
Open YubiKey Configuration Utility (or run ykman info).
Note the serial number, firmware, and supported interfaces (USB-A/USB-C, NFC).
Record intended role for this key (Primary FIDO2, Backup OTP, etc.).
Repeat for every YubiKey.

2) Label and document

Affix a durable label or record each key’s serial and assigned purpose in a secure inventory document.
Maintain a mapping: Serial → User/Role → Configured functions.

3) Configure common functions per key

Note: Some configurations require interaction with the service (e.g., registering a FIDO2 credential with your Google account). For such functions, configure the YubiKey with YKCU then register it on the service.

A) OTP (YubiOTP or HMAC-SHA1 challenge-response)

Open YKCU, go to OTP.
Choose a slot (Slot 1 usually for OTP used by yubico services; Slot 2 often for other uses).
Configure as YubiOTP or HMAC-SHA1 challenge-response as required.
If using challenge-response, record the secret/key securely and integrate with your authentication backend.

B) FIDO2 / WebAuthn

Ensure FIDO2 is enabled on the YubiKey (YKCU should show supported features).
For each service (Google, GitHub, Microsoft, etc.), go to the account’s security settings and add a new security key. When prompted, insert and touch the YubiKey to register the credential.
Repeat registration for each YubiKey you want associated with the account (primary plus backup).

C) PIV (Smart Card)

In YKCU or ykman, choose PIV.
Set or change PIN and PUK (store them securely).
Generate or import certificates for authentication/signing.
Enroll each YubiKey in any systems that rely on the PIV certificate (VPNs, Windows smartcard login, etc.).

D) OpenPGP

Use YKCU or GPG + ykman to generate/import OpenPGP keys.
Configure touch policy (require touch for sign/auth operations) per your security posture.
Distribute public keys to relevant parties; private keys remain on-device.

4) Register each YubiKey with dependent services

For each service that uses YubiKey (email, password managers, GitHub, AWS IAM, Windows login), register all intended YubiKeys as authenticators in that service’s security settings.
Test every registered YubiKey to ensure it works as expected (log out and log in using each key).

5) Backup and recovery process

Keep backup YubiKeys configured identically for critical accounts.
Store backup keys in locked, secure physical storage (safe or secure deposit box).
Document the recovery steps clearly: which key is primary, which is backup, and who has access.

Example workflow: Provisioning 3 keys per user (Primary, Backup, Admin)

Inventory keys and assign role labels (User1-Primary, User1-Backup, User1-Admin).
Configure Primary:
- Slot 1: YubiOTP for service X
- FIDO2: register with Google, GitHub
- PIV: import user cert
Configure Backup:
- Mirror Primary’s OTP and FIDO2 registrations on services (register separately)
- Store PIV cert if policy allows (or keep blank for security)
Configure Admin:
- Limited to admin actions only (PIV with admin cert)
- Keep secure and offsite for emergency recovery
Test all three keys on each service and document results.

Best practices and security considerations

Use touch policies for operations that should require user presence (signing/authentication) to prevent unauthorized use if a YubiKey is briefly plugged in.
Keep PINs, PUKs, and any secrets in a secure password manager or enterprise secrets manager.
Never export private keys from a YubiKey. Instead, provision identical credentials by registering each key separately with the service.
Rotate keys periodically and when a key is lost or suspected compromised.
Use unique roles/purposes per key rather than overloading a single key for everything.
Maintain an incident response plan to quickly revoke and re-register keys if needed.