FIDO2, passkeys & YubiKeys

Innovexus supports phishing-resistant login with platform passkeys and hardware security keys (YubiKey and any FIDO2 authenticator). Browsers enforce strict preconditions — this page explains them so login “just works” instead of mysteriously not appearing.

The three requirements

WebAuthn (the browser API behind passkeys) is only exposed when all three of these hold. Miss any one and the login page reports “WebAuthn is not supported in this browser” — on every browser:

1. HTTPS, not HTTP. Browsers withhold the API entirely outside a secure context. (TLS mode none therefore disables passkey login — the setup wizard warns about this.)
2. A real DNS name, not an IP address. Each credential is bound to a Relying Party ID, which must be a registrable domain. An IP literal can never be one — this is a WebAuthn rule, not an Innovexus limitation, and it is why the setup wizard refuses an IP as the appliance FQDN. Browse to https://innovexus.example.com/, not https://192.0.2.10/, when registering or using passkeys.
3. A certificate the browser actually trusts. Clicking through the “your connection is not private” warning is not enough — the page loads, but the browser still refuses WebAuthn. With the default appliance-signed certificate you must install the appliance root CA on each administrator’s machine.

Installing the appliance root CA

Download the root CA from ADMIN → PKI → Trusted Certificate Store in the web UI (or use the file the setup wizard pointed at). Verify its SHA-256 fingerprint against show certificate in the CLI before trusting it, then install:

After installing, restart the browser and confirm the padlock shows no warning at https://<fqdn>/. Passkey registration will now work.

Registering a passkey or YubiKey

1. Sign in to the web UI with your password.
2. Open your account’s security settings and choose Register security key / passkey.
3. Follow the browser prompt — touch the YubiKey, or approve with the platform authenticator (Touch ID, Windows Hello, phone).
4. Register a second authenticator if you can. Two tokens make the lost-token procedure below something you may never need.

Requiring a hardware token

An account can be marked as requiring a security key, making the password alone insufficient. That is the right posture for super admins — with one caveat: a required token that is lost locks the account. Which brings us to…

Lost YubiKey / passkey

If the account holder still has another registered authenticator, they sign in with that and remove/replace the lost one in the web UI. If the only token is gone and the account requires one, use the CLI break-glass (full walkthrough):

innovexus> web-admin reset
…prompts…
Also clear a passkey/YubiKey REQUIREMENT on this account (lost token)? [y/N] y
password reset for 'jsmith' (role super_admin); passkey/YubiKey requirement cleared
the account is active and unlocked — sign in at the web UI now

The administrator signs in with the new password, registers a replacement token, and re-enables the requirement. Remove the lost token’s registration in the web UI so a found-or-stolen key is useless.

Troubleshooting passkey login