> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-fault-finding-cards-with-s.md). # Cards with Site Specific Keys do not work Diagnose and resolve cards encoded with a Site Specific Key that do not work. A number of solutions for Site Specific Key encoded credentials you may run into. ### Cards encoded by Gallagher are not working Use this when DESFire cards supplied by Gallagher do not work, and the readers make only a single beep when the cards are presented. Check the following: 1. Was the site installed recently, at vEL8.20 or above? If so, it most likely has a unique MIFARE site key. 2. Was the SSK exported from the system and supplied to Sales before the card order? * If **no**, it is highly probable the cards are encoded with the Default Gallagher MIFARE keys. Use the rolling keys procedure. * If **yes**, was a test set of cards provided and tested successfully? * If yes, has the site possibly generated another set of keys since then? This breaks previously ordered cards unless the site still has the original export that was sent to Sales. If they do, have them import it back into Command Centre. The same fault finding applies to a site that has just switched to unique keys. > **Important.** Check that the readers and doors are configured on the same door. Cross-controller configuration can cause the same symptom if the controllers cannot talk to one another. ### Admin Cards and Cardax IV connected readers If a Gallagher T-series reader is connected via Cardax IV or to a Protocol Converter, and it needs to read cards that use a non-default Gallagher key, you have to apply the Site Specific Key to the reader with an Admin Card. The Cardax IV protocol does not support transferring Site Specific Keys to the reader, so the Admin Card is the alternative method for moving the keys onto the reader. > **Important.** Keys **cannot** be put onto a T-series reader while it is connected to a Protocol Converter. The only way an SSK can be pushed onto a reader is for the reader to be connected, and configured, as a Cardax IV reader to a controller, and for an Admin Card to be presented to it. ### Admin Card requirements * The card must be a **blank MIFARE Plus 4k or DESFire 4k card, minimum**. * The site does not need encoding enabled on the license, just a USB encoder. * **Allow Admin card update at readers** must be checked in Server Properties > Card Security. ### Creating and applying an Admin Card 1. In Configuration Client, go to **Server Properties > Card Security**. 2. Check **Allow Admin card update at readers**. ![Server Properties Card Security showing Admin Card options](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-f42dbf5d783cf90f2e0632b7b9ea6927011c7324%2FSECHUB-CREDENTIALS-CARD-01-admin-card-server-properties.png?alt=media) 3. Click **Generate an Admin Card**. ![Generate Admin Card dialog in Configuration Client](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-63420a9e9bbadc420bf446012be1e217a4e7a0bd%2FSECHUB-ENCODING-TS-01-generate-admin-card-cardax-iv.png?alt=media) 4. Encode the Admin Card onto a blank MIFARE Plus 4k or DESFire 4k card. 5. Disconnect the T-series reader from the Protocol Converter. 6. Connect and configure the reader as a Cardax IV reader to a controller. 7. Present the Admin Card to the reader. It flashes white 3 times, then resumes functionality with the new keys. 8. Reconnect the reader to the Protocol Converter. > **Note.** The Site Specific Keys will be wiped if a Cardax IV connected reader has **Reset to Factory Defaults** selected on its Status and Overrides page. ### Version-specific key storage behavior | Version | Key storage behaviour | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | vEL8.20 and below | Connecting a T-series reader to HBUS and configuring it does send the keys to the HBUS reader, but the keys do **not** stay available when the reader is powered down and reconnected as a Cardax IV reader. | | vEL8.30 and above | MIFARE Classic, Plus, and DESFire keys are held on the **controller**, not in the reader. If a reader that has SSKs loaded is connected via HBUS to a vEL8.30 or above controller, the firmware is upgraded and the SSK is **wiped from the reader**, so the Admin Card process has to be performed again. | *** 🔗 **Related** * [Credentials - Site Specific Key (SSK) vs Default Site Key](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-site-specific-key-ssk-vs-d.md). Confirming whether the site uses an SSK, and the workaround when it already has. * [Credentials - Rolling keys on cards issued to a new site with a SSK](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-rolling-keys-on-cards-issu.md). The fix when the cards were encoded with Default keys. * [Credentials - Keys](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-keys.md). What the Card Master Key, Default Application Key, and Site Specific Key each do. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-fault-finding-cards-with-s.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.