PIV Card Not Recognized on Mac After Reboot Fix

Why PIV Cards Fail Specifically After Reboot

PIV card troubleshooting on Mac has gotten complicated with all the conflicting advice flying around. And the post-reboot failure is its own specific beast — it looks like a general smart card problem, but it isn’t. As someone who spent an embarrassing number of hours chasing this exact issue across two different MacBook Pros, I learned everything there is to know about why your PIV card works perfectly before shutdown and then vanishes completely after a restart. Today, I will share it all with you.

Two distinct mechanisms cause this. First: USB selective suspend. macOS re-enables power-saving features on USB ports during boot, and your card reader gets starved of power before the system even finishes loading. Second: sc_auth pairing breakage. The smart card daemon loses its cryptographic tie to your local account after a kernel extension loads — or after a system update changes how CryptoTokenKit initializes. These require completely different fixes. Generic CAC reader troubleshooting won’t touch either one.

First Check — USB Power Management Is Killing Your Reader

Probably should have opened with this section, honestly. Half of post-reboot PIV failures stop the moment you disable USB selective suspend. I spent three hours reinstalling CCID drivers before realizing my MacBook Air was simply cutting power to the reader during sleep cycles. Don’t make my mistake.

Open Terminal and run this command:

sudo pmset -a usbinactivity 0

This tells your Mac to never put USB devices into low-power mode — even during sleep. The value is in minutes. Zero means off permanently. Run it, then restart.

Your PIV card should recognize on boot now. If it does, you’re done. If it doesn’t, move on to the next section.

One thing worth knowing: government-managed Macs running MDM profiles can re-enable selective suspend after system updates push through. I’m apparently on a quarterly update cycle and pmset gets reset on me every few months. Check this setting after any major macOS patch if your card suddenly stops cooperating.

But what is USB selective suspend, exactly? In essence, it’s macOS cutting power to idle USB ports to conserve energy. But it’s much more than that — Apple significantly changed this behavior starting in Monterey, and older reader firmware simply doesn’t wake cleanly from suspension. The reader is physically connected. It’s just asleep when your system needs it most.

Reset the Smart Card Pairing With sc_auth

So USB power management wasn’t the issue. That means your sc_auth pairing broke. The smart card daemon lost the cryptographic binding between your PIV card and your local user account — system updates, kernel extension changes, and certain security patches can all sever this link without warning.

First, get your card’s hash. Insert your PIV card, then run:

sc_auth identities

You’ll see output that looks like (5B7A3C9E...). Copy that hash. Now unpair and repair using the commands below — replace HASH with your actual hash and USERNAME with your login name:

sudo sc_auth unpair -h HASH

sudo sc_auth pair -h HASH -u USERNAME

You’ll be prompted for your Mac password. Enter it. The daemon rebuilds the pairing and your card should register immediately. No restart required.

This requires admin rights. If you’re on a managed MDM profile — common in federal and state government environments — your IT department may need to run this for you. A “Not authorized” error means your account permissions are blocked. Contact them first rather than trying workarounds.

One honest mistake I made here: I assumed the pairing would persist forever after running this once. It will persist — until your organization pushes out a macOS security update. That can break the pairing again. Running sc_auth pair a second time post-update is completely normal. Not a hardware failure. Just a Tuesday.

Clear the CCID Driver State Without a Full Restart

Frustrated by a card reader that showed up perfectly in System Information but refused to actually read anything, I stumbled onto this fix completely by accident. The CCID driver — the software layer communicating with your reader — gets stuck in a bad state sometimes. The reader appears under USB devices. Your card slides in smoothly. Nothing reads.

Killing the daemon and letting macOS restart it clears this without a full system reboot. Run:

sudo killall -9 com.apple.ifdreader

The daemon restarts automatically within seconds. Insert your card. Most readers initialize within 10 seconds after this command — I’ve clocked mine at around 7 seconds on a 2021 MacBook Pro M1.

Use this specifically when System Information shows your reader under USB Bus Power, but Keychain Access or your authentication software shows no card present. The hardware is working fine. The driver just needs a cold restart. This fix costs nothing and takes under 30 seconds. That’s what makes it so useful for anyone dealing with a flaky reader mid-workday.

Still Broken — What to Check Before Calling IT

If none of those fixes worked, run through this checklist before escalating. So, without further ado, let’s dive in.

1. Verify the reader shows in System Information. Click the Apple menu, then System Information, then USB. Look for your reader by brand and model — commonly a Kingston FCR-HS4, Identiv uTrust 3700F, or Gemalto IDBridge CT30. Not there? The port may be dead, or the reader is genuinely disconnected. Try a different USB port before assuming anything.
2. Check Console for actual errors. Open Console.app and search for “CCID” or “CryptoTokenKit.” Look for stack traces or repeated error messages. Copy them and send them to IT verbatim. Don’t interpret them yourself — let the people with access to your MDM logs read them.
3. Confirm your card isn’t expired. Federal PIV cards expire. Expired cards frequently trigger “not recognized” errors instead of a clear expiration warning. Check the physical card. The date is printed right on it.
4. Test on a second USB port or a powered hub. Some Mac USB ports deliver less consistent power when other devices share the bus. A powered USB 3.0 hub — something like the Anker 10-port model, around $40 — sometimes solves what looks like a software problem but is actually a power delivery issue.
5. Run sc_auth identities one more time. Empty brackets or no output means the card itself may be damaged or corrupted. That’s hardware-level. A replacement card from your issuing agency is the only path forward from there.

That checklist separates software configuration issues — which cover most cases — from actual hardware failures, which are rare but real. If your reader appears in System Information and sc_auth sees the card but authentication still fails after all of the above, you’re looking at hardware. Your IT team can order a replacement or send the reader in for service. Either way, you’ve done everything possible on your end.