Quick Answer
"No valid certificates found on this smart card" means Windows sees the YubiKey but finds no usable certificate in its PIV slots. Confirm a certificate is loaded in slot 9a/9c with YubiKey Manager, install the YubiKey Smart Card Minidriver, ensure the Smart Card service is running, and re-enroll or import the certificate if the slot is empty or expired.
Symptom fingerprint
The exact strings, error codes, and UI surfaces that map to this issue:
| UI message | Surface | Code |
|---|---|---|
| No valid certificates were found on this smart card | Windows Security certificate picker | — |
| Please make sure your smart card is inserted / no certificates available | Browser or app signing prompt | — |
| YubiKey blinks / is detected but no cert is offered | Signing flow after PIN entry | — |
Why a working YubiKey shows no certificate
The YubiKey supports several applications (PIV, FIDO2, OpenPGP, OATH). Signing and Windows smart-card login use the PIV application, and Windows only offers certificates that live in a PIV slot with a matching private key. If the slot is empty, holds only a key without a certificate, or the certificate has expired, Windows reports "no valid certificates found" even though the device is perfectly healthy.
The second common cause is a driver gap: without the YubiKey Smart Card Minidriver, Windows can't correctly enumerate the certificate objects on the card.
Step 1 — Inspect the PIV slots
Windows only offers certificates that live in a PIV slot with a matching key, so check what's actually loaded first.
- Install and open YubiKey Manager → Applications → PIV → Configure Certificates.
- Check slot 9a (Authentication) and 9c (Digital Signature) — a usable signing setup needs a certificate AND its private key in the slot.
- If a slot shows a key but "No certificate", you must import/generate the certificate for that key.
- If a certificate is present, check its expiry — an expired cert is treated as invalid.
Step 2 — Install the minidriver and restart the service
Even with a certificate in the slot, Windows needs the YubiKey minidriver to enumerate and present it to signing apps.
- Install the "YubiKey Smart Card Minidriver" (separate from YubiKey Manager).
- services.msc → Smart Card (SCardSvr): Running + Automatic; restart after install.
- Unplug and replug the YubiKey so Windows re-enumerates it under the minidriver.
Step 3 — Enroll or import a certificate
If the slot is empty or only holds a bare key, load a certificate so Windows has something to offer.
- Import an existing .pfx/.p12 into slot 9c via YubiKey Manager → PIV → Certificates → Import.
- Or generate a key in 9c and enroll against your CA (org/US Federal PKI) to get a signing certificate.
- Re-test in certmgr.msc → Personal — the YubiKey certificate should appear with a key icon.
Diagnostic sequence
Run each step in order. Stop at the first failing expectation — that's where the root cause lives.
1. Confirm the card and certs
certutil -scinfo
Expected: YubiKey reader listed; at least one certificate with an associated private key.
2. List PIV certificates
ykman piv info
Expected: Slots 9a/9c show a certificate with a valid (non-expired) date range.
3. Verify Windows sees it
certmgr.msc → Personal → Certificates
Expected: The YubiKey certificate appears with a private-key icon and is selectable when signing.
Frequently asked questions
My YubiKey works for FIDO2 login but not for signing — why?
FIDO2 and PIV are different applications on the key. Signing certificates live in the PIV slots (9a/9c). A YubiKey configured only for FIDO2 has no PIV certificate, so Windows reports "no valid certificates found" when you try to sign.
Do I need YubiKey Manager and the minidriver, or just one?
Both. YubiKey Manager lets you inspect and load PIV slots; the YubiKey Smart Card Minidriver lets Windows enumerate and present those certificates to apps. Missing the minidriver is a frequent cause of this error.
The certificate is in slot 9c but still not offered.
Check that the certificate hasn't expired, that its Key Usage includes Digital Signature, and that the Smart Card service restarted after the minidriver install. If it still fails, the key and certificate in the slot may be mismatched — re-import as a matched pair.
You might also need
More fix guides in Smart Card and related areas.
Still seeing this error?
If these steps don't isolate the root cause inside your environment, an independent consultant can run a structured PKI diagnostic with you over a screen-shared session and deliver a written report identifying root cause, remediation, and — where relevant — the next responsible party (CA, internal IT, or software vendor).
Book a remote diagnostic →Includes a written diagnostic summary. Independent consulting engagement — not affiliated with DocuSign, Adobe, or Microsoft.
Comments
Loading comments…