# Debian 12 - fido2luks - enroll 2 key

**URL:** https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282
**Category:** FIDO2 / Nitrokey 3
**Created:** [June 21, 2024, 1:59pm UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282 "2024-06-21T13:59:38Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![nitrokey3-user](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/n/a9a28c/32.png) [@nitrokey3-user](https://support.nitrokey.com/u/nitrokey3-user)
#### Post date: [June 21, 2024, 1:59pm UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/1 "2024-06-21T13:59:38Z")

</div>

Thanks to the forum, I used the following procedure on github :

> **[GitHub - bertogg/fido2luks: Unlock LUKS volumes at boot time using a FIDO2...](https://github.com/bertogg/fido2luks)**
>
> Unlock LUKS volumes at boot time using a FIDO2 token and initramfs-tools - bertogg/fido2luks

I enrolled my first nitrokey3 with :

systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=true --fido2-with-user-presence=true /dev/XXX

Now I physically remove my first key, and try to enroll my second key with the same command :

systemd-cryptenroll --fido2-device=auto --fido2-with-client-pin=true --fido2-with-user-presence=true /dev/XXX

If I try to test my two fido2 keys, they open one slot each:

cryptsetup --verbose open --test-passphrase --token-only /dev/nvme0n1p5

However, when I boot, only the first key I enrolled works. The second is not recognized.

Any ideas?

---

<div class="post-metadata">

### Author: ![berto](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/b/51bf81/32.png) [@berto](https://support.nitrokey.com/u/berto)
#### Post date: [September 30, 2024, 11:06am UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/2 "2024-09-30T11:06:25Z")

</div>

Unfortunately that tool only tries to use the first registered FIDO2 token, it would need to be modified to support more than one.

---

<div class="post-metadata">

### Author: ![berto](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/b/51bf81/32.png) [@berto](https://support.nitrokey.com/u/berto)
#### Post date: [August 5, 2025, 9:28am UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/3 "2025-08-05T09:28:30Z")

</div>

Hi, fido2luks 0.0.2 has just been released with support for multiple fido2 keys.

---

<div class="post-metadata">

### Author: ![nitrokey3-user](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/n/a9a28c/32.png) [@nitrokey3-user](https://support.nitrokey.com/u/nitrokey3-user)
#### Post date: [August 9, 2025, 9:47am UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/4 "2025-08-09T09:47:50Z")

</div>

Thanks — I just broke my second Nitrokey. I’ll order another one and give it a try. But it’s still super cool!

---

<div class="post-metadata">

### Author: ![nitrokey3-user](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/n/a9a28c/32.png) [@nitrokey3-user](https://support.nitrokey.com/u/nitrokey3-user)
#### Post date: [November 19, 2025, 1:03am UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/5 "2025-11-19T01:03:25Z")

</div>

I wanted to thank you — I treated myself and bought a new Nitrokey 3A NFC, so I now have a second key in addition to my Nitrokey 3A Mini.

And your script works great; I was able to enroll both Nitrokeys and everything works perfectly.

I even had fun trying it with a Ledger key — I just disabled the PIN prompt, since the PIN is entered directly on the Ledger itself, and it works as well.

So now, to unlock my laptop, I can choose between:

- Nitrokey 3A Mini (it’s cool, it always stays plugged into my laptop)

- Nitrokey 3A NFC (it’s my backup that I keep elsewhere)

- A Ledger key

So I don’t need any password anymore, and I removed the password from my LUKS volume.

Many thanks for updating your script!

---

<div class="post-metadata">

### Author: ![Matej\_Kovacic](https://support.nitrokey.com/user_avatar/support.nitrokey.com/matej_kovacic/32/1880_2.png) [@Matej\_Kovacic](https://support.nitrokey.com/u/Matej_Kovacic)
#### Post date: [May 20, 2026, 10:33am UTC](https://support.nitrokey.com/t/debian-12-fido2luks-enroll-2-key/6282/6 "2026-05-20T10:33:48Z")

</div>

Based on Alberto’s Garcia script I prepared “FIDO2LUKS extended” version: [https://github.com/MatejKovacic/fido2luks-extended](https://github.com/MatejKovacic/fido2luks-extended)

It has support for Plymouth bootsplash, multiple languages, and user can suppress technical/debug messages and show only user-friendly output.