> Can you recommend a setup guide?

Depends how far up the chain you want to go (e.g. use step-ca or not), but at the most primitive level, you are looking at something along the following lines of the below (the below is based off my rough notes, I might have missed something).

Note that I have ignored any Yubikey setup considerations here like setting PIN, touch-requirement etc. etc.

I have also assumed plain Yubikey, not the YubiHSM. The YubiHSM comes with SSH certificate signing functionality "out of the box".

Client Yubikey:

   - Use Yubikey ykman[1] to generate a PIV key according to your tastes
   - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $client_key.pub`

Issuer Yubikey:

   - Use Yubikey ykman[1] to generate a PIV key according to your tastes
   - Grab the key in ssh format with `ssh-keygen -D $path_to/libykcs11 -e > $issuer_key.pub` (save this for the next step and also put it into your sshd CA config)
   - Sign with the issuer Yubikey with `ssh-keygen -s $issuer_key.pub -D $path_to/libykcs11 -I $whatever_identity -n $principal_list -V +$validity_period $client_key.pub`

(libykcs11 is the yubikey library,it ships with yubikey-piv-tool[2])

[1] https://docs.yubico.com/software/yubikey/tools/ykman/PIV_Com... [2] https://developers.yubico.com/yubico-piv-tool/Releases/

==== Edit to add links to various more verbose discussions on the subject (in no particular order):

    - https://liw.fi/sshca/
    - https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication/
    - https://jamesog.net/2023/03/03/yubikey-as-an-ssh-certificate-authority/
    - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-ssh_certificate_pkcs_11_token

Also some verbose discussions on the possibility of doing so with FIDO2. Altough note that the native version of ssh on Apple OS X does not support FIDO2, therefore if you want native Apple support you are best sticking with the PIV method instead.

    - https://developers.yubico.com/SSH/Securing_git_with_SSH_and_FIDO2.html
    - https://medium.com/@harrishcluo/yubikey-ssh-git-super-secure-your-development-workflow-2-2-1899379fb882
    - https://blog.millerti.me/2021/05/16/strengthen-github-ssh-access-with-fido2s-pin-support/