Sure! There are a lot of ways you can do this. One is to use PIV mode, which exposes a PKCS#11 interface that can be used by OpenSSL. Yubico has some nice docs on using a Yubikey as an HSM to store CA keys: <a href="https:&#x2F;&#x2F;developers.yubico.com&#x2F;yubico-piv-tool&#x2F;Certificate_Authority.html" rel="nofollow">https:&#x2F;&#x2F;developers.yubico.com&#x2F;yubico-piv-tool&#x2F;Certificate_Au...</a><p>Note that (at least in the method described in that document), the Yubikey does not _generate_ the private key, it merely stores it securely. You need to generate it on a computer, which should preferably be a brand new laptop, airgapped, purchased from a physical store and not online (continue to layer defenses up to your desired level of paranoia).