# HSM2 - ReApply firmware - is it possible?
**URL:** https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778
**Category:** Nitrokeys
**Created:** [October 13, 2026, 10:32pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778 "2026-10-13T22:32:55Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@mmfin](https://support.nitrokey.com/u/mmfin)
#### Post date: [October 13, 2026, 10:32pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/1 "2026-10-13T22:32:55Z")
I have two Nitrokey HSM 2 tokens (firmware 4.1), serials DENK0400133 and
DENK0400273, previously initialized for testing. The SO-PINs were lost, and
both the SO-PIN and user PIN are now blocked on each token.
I attempted the forum guidance here ( [Re-initialize NitroKey HSM 2](http://support.nitrokey.com/t/re-initialize-nitrokey-hsm-2/7773) ), through [pki-as-a-service.net](http://pki-as-a-service.net). Both tokens show “SO-PIN locked” and “User PIN locked” in sc-hsm-tool. The portal authenticates the device (green tick) but then Requires the user PIN to log in and reports “SmartCard-HSM User-PIN blocked (6983)” and goes into a loop.
Is there any way to reload the firmware or otherwise recover these tokens when
both PINs are blocked? They hold only test keys, and erasing them is the goal.
---
### Author:  [@sc-hsm](https://support.nitrokey.com/u/sc-hsm)
#### Post date: [October 14, 2026, 7:34am UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/2 "2026-10-14T07:34:05Z")
Firmware can only be reloaded via the PKIaaS, as the process not only loads the firmware but also creates a new device certificate. However you need to have access to the portal to do that and you can not login with a blocked token for security reason.
You can of course register a new token for your account and then use that token for login. This allows you to reload the firmware on any of the token you have at hand.
It is not required to register the token with your account that you want update. You can do that with any token in your possession.
There is a reason why we recommend to start with a well-known SO-PIN and change to a private SO-PIN value once you go into production. We also recommend to use a [Managed SO-PIN](https://www.pki-as-a-service.org/km/managed-so-pin/), as this drastically reduces the risk of loosing the SO-PIN, while still maintaining a good level of security.
---
### Author:  [@mmfin](https://support.nitrokey.com/u/mmfin)
#### Post date: [October 15, 2026, 5:17am UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/3 "2026-10-15T05:17:49Z")
Thank you, that worked: I registered a working token (DENK0400184)
I was able to also get the other 2 “locked” connected, but when I try to update the firmware, i get “No V2 KMC defined for upgrade to V3 (Produce)”. for both. I suspect that’s not what I need to do.
Can you assist or provide the steps to reload the firmware on my two locked tokens please?
thank you in advance!
---
### Author:  [@sc-hsm](https://support.nitrokey.com/u/sc-hsm)
#### Post date: [October 15, 2026, 3:56pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/4 "2026-10-15T15:56:53Z")
Can you try again ? There was a configuration issue at the PKIaaS.
---
### Author:  [@mmfin](https://support.nitrokey.com/u/mmfin)
#### Post date: [October 15, 2026, 5:34pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/5 "2026-10-15T17:34:44Z")
I’m still getting the same error "No V2 KMC Defined for upgrade to V3 (error)
Error while talking to your smart card.
---
### Author:  [@sc-hsm](https://support.nitrokey.com/u/sc-hsm)
#### Post date: [October 15, 2026, 7:44pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/6 "2026-10-15T19:44:56Z")
Then it is more than a configuration error. I will have a look and come back.
---
### Author:  [@mmfin](https://support.nitrokey.com/u/mmfin)
#### Post date: [October 15, 2026, 8:09pm UTC](https://support.nitrokey.com/t/hsm2-reapply-firmware-is-it-possible/7778/7 "2026-10-15T20:09:03Z")
sweet, thanks!