When logging in via SmartCard with a YubiKey in PIV mode, ghost certificates sometimes appear – these are old certificates that Windows or applications display, even though they have been replaced.

The reason lies in the structure of the YubiKey: There are up to 24 slots for certificates, including primary slots like 9a for authentication and Retired slots (82 to 95), where old certificates are automatically stored to maintain chains or backups.

When renewing certificates, remnants end up in these Retired slots and become visible through Windows caching, which can lead to multiple login options or errors. Up to 20 Retired certificates are possible.

Prerequisite is the installation of the current version of YubiKey Manager (ykman) which can be downloaded from the Yubico website. The GUI will no longer be available from February 2026, so the command line (CLI) is recommended, which can also be installed without admin rights, e.g. via a INGOS self-service portal.

To find ghost certificates, first read out the slots to see what is stored on the YubiKey.

Open a command prompt and execute certutil -scinfo; the YubiKey PIN may need to be entered.

This shows all recognized certificates with their slots that Windows detects, often including cached or Retired entries.

For comparison, execute ykman piv info, which displays the hardware state and lists occupied slots, e.g. "Slot 9a: occupied" or "Retired Slot 84: occupied".

To delete, use ykman to proceed targeted, without completely resetting the YubiKey.

For a certificate in a Retired slot, e.g. 84, enter ykman piv certificates delete 84 and confirm with the YubiKey PIN. Repeat this for further slots, e.g. ykman piv certificates delete 85. Then check with ykman piv info if the slots are free, and restart the computer so that Windows updates the cache.

Any user can perform this as long as ykman is installed, even without admin rights. If many slots are affected, create a batch file with these commands for faster execution.