Writing cardholder certificates (DO 7F21) fails with "Security status not satisfied" #51

New Issue

2026-02-18T04:30:28+08:00

czietz commented

2026-02-18 04:30:28 +08:00

(Migrated from github.com)

Writing a cardholder certificate (DO 7F21) is normally done with gpg-card's writecert command. However, this command fails with "Wrong PIN", even though I entered the correct admin PIN. "Cardholder certificates support" is listed in the README.

To debug this further, I tried writing to DO 7F21 manually. While the admin PIN is correctly verified, writing still fails with "Security status not satisfied":

OpenSC Explorer version 0.26.1
Using reader with a card: Pol Henarejos Pico Key CCID OTP FIDO Interfac 0
OpenSC [3F00]> verify chv3
Please enter PIN: Code correct.
OpenSC [3F00]> apdu 00da7f21020000
Sending: 00 DA 7F 21 02 00 00
Received (SW1=0x69, SW2=0x82)
Failure: Security status not satisfied

Compare this to, e.g., a YubiKey:

OpenSC Explorer version 0.26.1
Using reader with a card: Yubico YubiKey OTP+FIDO+CCID 0
OpenSC [3F00]> verify chv3
Please enter PIN: Code correct.
OpenSC [3F00]> apdu 00da7f21020000
Sending: 00 DA 7F 21 02 00 00
Received (SW1=0x90, SW2=0x00)
Success!

Writing a cardholder certificate (DO 7F21) is normally done with gpg-card's `writecert` command. However, this command fails with "Wrong PIN", even though I entered the correct admin PIN. "Cardholder certificates support" is listed in the README. To debug this further, I tried writing to DO 7F21 manually. While the admin PIN is correctly verified, writing still fails with "Security status not satisfied": ``` OpenSC Explorer version 0.26.1 Using reader with a card: Pol Henarejos Pico Key CCID OTP FIDO Interfac 0 OpenSC [3F00]> verify chv3 Please enter PIN: Code correct. OpenSC [3F00]> apdu 00da7f21020000 Sending: 00 DA 7F 21 02 00 00 Received (SW1=0x69, SW2=0x82) Failure: Security status not satisfied ``` Compare this to, e.g., a YubiKey: ``` OpenSC Explorer version 0.26.1 Using reader with a card: Yubico YubiKey OTP+FIDO+CCID 0 OpenSC [3F00]> verify chv3 Please enter PIN: Code correct. OpenSC [3F00]> apdu 00da7f21020000 Sending: 00 DA 7F 21 02 00 00 Received (SW1=0x90, SW2=0x00) Success! ```

czietz commented

2026-02-20 03:01:23 +08:00

(Migrated from github.com)

Thank you. Now the "Security status not satisfied" error is gone. However, writing certificates still seems to fail. Reading them back either returns no data or a "not found" ("Nicht gefunden") error.

gpg/card> writecert 1 < C:\temp\cert.der
gpg/card> writecert 2 < C:\temp\cert.der
gpg/card> writecert 3 < C:\temp\cert.der
gpg/card> readcert 1 > con:
gpg/card> readcert 2 > con:
gpg/card> readcert 3 > con:
Command 'readcert' failed: Nicht gefunden

Thank you. Now the "Security status not satisfied" error is gone. However, writing certificates still seems to fail. Reading them back either returns no data or a "not found" ("Nicht gefunden") error. ``` gpg/card> writecert 1 < C:\temp\cert.der gpg/card> writecert 2 < C:\temp\cert.der gpg/card> writecert 3 < C:\temp\cert.der gpg/card> readcert 1 > con: gpg/card> readcert 2 > con: gpg/card> readcert 3 > con: Command 'readcert' failed: Nicht gefunden ```

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/pico-openpgp#51