apt install opensc-pkcs11 
 modutil -dbdir sql:.pki/nssdb/ -add "opensc" -libfile  /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

Install certificate with yubikey-piv-manager.

Note: Yubikey 4 and Yubikey 4 NEO require at least version 1.1.0, see https://developers.yubico.com/yubico-piv-tool/Release_Notes.html (currently not packaged in Debian/Ubuntu!)