🔐 PIV Applications

Default Credentials

Item	Value
PIN	123456
PUK	12345678
Management Key	010203040506070801020304050607080102030405060708

Using PIV with VeraCrypt

1. Install Required Software

Install the following software for your operating system:

• VeraCrypt
• OpenSC
• yubico-piv-tool

2. Recognition Test

Command 1: List PKCS#11 Slots

&"C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe" --list-slots

Expected output:

Available slots:
Slot 0 (0x0): miixpro 0
  token label        : PIV_II
  token manufacturer : piv_II
  token model        : PKCS#15 emulated
  token flags        : login required, rng, token initialized, PIN initialized
  hardware version   : 0.0
  firmware version   : 0.0
  serial num         : 5cbc37b5afb4b9ac
  pin min/max        : 4/8
  uri                : pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=5cbc37b5afb4b9ac;token=PIV_II

Command 2: Check PIV Status

yubico-piv-tool -r miixpro -a status

Expected output:

Version:        5.7.0
Serial Number:  3793437186
CHUID:  3019d4e739da739ced39ce739d836858210842108421c84210c3eb341058e4d26a85109b0c775447e7126669fa350832303530303130313e00fe00
CCC:    f0159a625c4ad630ef52d6955688f1d92fbe6e4fffd911f10121f20121f300f40100f50110f600f700fa00fb00fc00fd00fe00
All non-listed slots are empty
PIN tries left: 3

3. Configure VeraCrypt

Step 1 — Add OpenSC Library Path

1. Go to Settings → Security Tokens → Select Library.
2. Enter the path: C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll (use the corresponding path for other operating systems).
3. Then go to Tools → Manage Security Token Keyfiles and enter your PIN. You should see the token loaded successfully.

Step 2 — Generate Keyfile

Go to Tools → Keyfile Generator to create a keyfile.

Step 3 — Convert to Base64

# Windows
[Convert]::ToBase64String([IO.File]::ReadAllBytes("keyfile.dat")) | Set-Content -Encoding ASCII "keyfile.dat.base64"

# Linux
base64 keyfile.dat > keyfile.dat.base64

Step 4 — Upload Keyfile to Object Slot

yubico-piv-tool -r miixpro -a write-object -k --id 0x5fc108 -i keyfile.dat.base64 -f base64

---

Use miixpro PIV to Sign Word Documents

This example creates a test signing certificate on Windows, imports its private key and certificate into the PIV Digital Signature slot (9c), associates the public certificate with the smart-card private key, and uses it to sign a Microsoft Word document.

1. Prepare a Working Directory

Open PowerShell and create a dedicated folder:

$workDir = Join-Path $env:USERPROFILE "Desktop\office-sign"
New-Item -ItemType Directory -Path $workDir -Force | Out-Null
Set-Location $workDir
openssl version

Continue only after openssl version reports the installed OpenSSL version.

2. Create the OpenSSL Configuration

Create openssl.cnf in the working directory with the following content. Replace the example organization and signer name before generating the certificate.

[ req ]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
x509_extensions = v3_req

[ dn ]
C = US
O = Example Organization
CN = Example Signer

[ v3_req ]
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature, contentCommitment
extendedKeyUsage = 1.3.6.1.4.1.311.10.3.12
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer

1.3.6.1.4.1.311.10.3.12 is Microsoft's Document Signing EKU used for signing documents in Office. The certificate is an end-entity certificate, so CA:FALSE is used.

3. Generate the Private Key and Test Certificate

openssl genrsa -out mycert.key 2048
openssl req -new -x509 -key mycert.key -out mycert.crt -days 365 -config openssl.cnf
openssl x509 -in mycert.crt -noout -subject -dates -ext keyUsage -ext extendedKeyUsage

The commands create:

• mycert.key — the private key generated on this computer.
• mycert.crt — the self-signed public certificate.

4. Package the Key and Certificate as PFX

openssl pkcs12 -export -out mycert.pfx -inkey mycert.key -in mycert.crt -name "miixpro-office-signing"

OpenSSL prompts for an export password. Use a unique temporary PFX password; do not reuse the PIV PIN and do not place the password directly on the command line.

5. Import the PFX into PIV Slot 9c

Keep the correct miixpro card profile selected, then run:

yubico-piv-tool -r miixpro -s 9c -a import-key -a import-certificate -i "$env:USERPROFILE\Desktop\office-sign\mycert.pfx" -K PKCS12 -k

Enter the PFX export password and the current miixpro PIV management key when prompted. Do not paste either secret into the command itself.

Expected success messages:

Successfully imported a new private key.
Successfully imported a new certificate.

Verify the selected profile and slot status:

yubico-piv-tool -r miixpro -a status

Slot 9c should no longer be reported as empty.

6. Import the Public Certificate into Windows

Convert the certificate to DER and import it into the current user's Personal certificate store:

openssl x509 -in mycert.crt -outform DER -out mycert.cer

$certificate = Import-Certificate `
  -FilePath "$env:USERPROFILE\Desktop\office-sign\mycert.cer" `
  -CertStoreLocation "Cert:\CurrentUser\My"

$thumbprint = $certificate.Thumbprint
$thumbprint

Keep the displayed thumbprint. The following steps use that exact certificate instead of a broad subject-name match.

7. Associate the Certificate with the Smart-Card Private Key

First check whether Windows has already linked the certificate:

Get-Item "Cert:\CurrentUser\My\$thumbprint" |
  Format-List Subject, Thumbprint, HasPrivateKey

If HasPrivateKey is already True, skip the repair command. Otherwise, keep miixpro connected and run:

certutil -v -user -f -csp "Microsoft Smart Card Key Storage Provider" -repairstore My $thumbprint

A successful repair normally includes a passed signature test and ends with CertUtil: -repairstore command completed successfully.

8. Verify the Association

Get-Item "Cert:\CurrentUser\My\$thumbprint" |
  Format-List Subject, Thumbprint, HasPrivateKey

certutil -user -store My $thumbprint

The PowerShell result must show:

HasPrivateKey : True

9. Sign a Word Document

1. Open the document in the desktop edition of Word.
2. Select Insert → Signature Line → Microsoft Office Signature Line.
3. Enter the signer information and select OK.
4. Right-click the signature line and select Sign.
5. If required, select Change and choose the certificate created for the example signer.
6. Select Sign, enter the current PIV PIN, and approve on miixpro if the active policy requests physical confirmation.
7. Save the document. Word displays the signature indicator and makes the signed document read-only to protect the signature.

You can inspect the result under File → Info → View Signatures.

10. Troubleshooting

Problem	What to check
certutil -repairstore reports CRYPT_E_EXISTS	An old certificate or key association may already exist. Inspect the exact thumbprint and container before removing anything; see the cleanup procedure below.
Word does not list the certificate	Confirm that it is in Current User → Personal, is not expired, contains the Document Signing EKU, and reports HasPrivateKey : True.
The PIV PIN is rejected	Stop before exhausting the retry counter. Confirm the selected card profile and current PIN. Three consecutive failures can lock the PIN and require the PUK.
yubico-piv-tool cannot find the reader	Confirm PIV is enabled, select the intended Smart Card profile, reconnect miixpro, and retry yubico-piv-tool -r miixpro -a status.
The signature is shown as untrusted on another computer	A self-signed test certificate is not automatically trusted by recipients. Use a certificate issued by a trusted CA for external or production documents.

Remove a stale test association only when required

# Inspect the exact test certificate before removal
Get-Item "Cert:\CurrentUser\My\$thumbprint" |
  Format-List Subject, Thumbprint, HasPrivateKey

# Remove only that exact test certificate
Remove-Item -LiteralPath "Cert:\CurrentUser\My\$thumbprint"

# List smart-card key containers before choosing one
certutil -key -csp "Microsoft Smart Card Key Storage Provider"

# Run only after replacing the placeholder with the exact stale test container
certutil -user -delkey "<EXACT_TEST_CONTAINER_NAME>"

After cleanup, import mycert.cer again and repeat the association step. Restart Windows only if the smart-card provider remains stale after reconnecting miixpro.

11. Security and Trust Notes

• This example generates the private key on the computer before importing it into miixpro. The files mycert.key and mycert.pfx remain additional private-key copies until they are securely archived or removed.
• A self-signed certificate is appropriate for functional testing and controlled internal use. It does not establish a publicly trusted identity.
• For external or regulated documents, obtain a suitable document-signing certificate from a trusted certificate authority and follow the organization's certificate policy.
• Keep the PIN, PUK, management key, PFX password, and any private-key backup secret. Do not include them in screenshots, support logs, or shared scripts.
• Because the five Smart Card profiles are independent, verify the selected profile before importing or signing.

Official References

• Microsoft: Add or remove a digital signature for Microsoft 365 files
• Microsoft: Document Signing application-policy OID
• Microsoft: certutil reference
• Yubico: Import a key and certificate into PIV
• OpenSSL: X.509 v3 extension configuration