diff --git a/client/src/common/validators.ts b/client/src/common/validators.ts
index 9f0a96deb94..e6fb88dbe67 100644
--- a/client/src/common/validators.ts
+++ b/client/src/common/validators.ts
@@ -131,17 +131,14 @@ export const claimAndBootstrapLinkValidator: IValidator = async function (value:
   if (value.length === 0) {
     return { validity: Validity.Intermediate };
   }
-  // TODO: REPLACE WHEN LIBPARSEC HANDLES PKI LINKS
-  if (value.includes('a=pki_enrollment')) {
-    return { validity: Validity.Valid };
-  }
   const result = await parseParsecAddr(value);
 
   if (
     result.ok &&
     (result.value.tag === ParsedParsecAddrTag.OrganizationBootstrap ||
       result.value.tag === ParsedParsecAddrTag.InvitationUser ||
-      result.value.tag === ParsedParsecAddrTag.InvitationDevice)
+      result.value.tag === ParsedParsecAddrTag.InvitationDevice ||
+      result.value.tag === ParsedParsecAddrTag.PkiEnrollment)
   ) {
     return { validity: Validity.Valid };
   }
@@ -245,9 +242,9 @@ export const pkiLinkValidator: IValidator = async function (value: string) {
   if (value.length === 0) {
     return { validity: Validity.Intermediate };
   }
-  // TODO: REPLACE WHEN LIBPARSEC HANDLES PKI LINKS
-  if (value.includes('a=pki_enrollment')) {
-    return { validity: Validity.Valid };
+  const result = await parseParsecAddr(value);
+  if (result.ok) {
+    return result.value.tag === ParsedParsecAddrTag.PkiEnrollment ? { validity: Validity.Valid } : { validity: Validity.Invalid };
   }
-  return { validity: Validity.Invalid };
+  return { validity: Validity.Invalid, reason: '' };
 };
diff --git a/client/src/components/devices/ChooseAuthentication.vue b/client/src/components/devices/ChooseAuthentication.vue
index 1864172d359..bd42f44abd1 100644
--- a/client/src/components/devices/ChooseAuthentication.vue
+++ b/client/src/components/devices/ChooseAuthentication.vue
@@ -48,7 +48,6 @@
         </ion-radio>
 
         <ion-radio
-          v-show="smartcardAvailable"
           class="item-radio radio-list-item"
           label-placement="end"
           justify="start"
diff --git a/client/src/components/invitations/PkiRequestItem.vue b/client/src/components/invitations/PkiRequestItem.vue
index 24a33a6d732..0878058b86b 100644
--- a/client/src/components/invitations/PkiRequestItem.vue
+++ b/client/src/components/invitations/PkiRequestItem.vue
@@ -9,20 +9,21 @@
     <!-- request - mobile version -->
     <div
       class="pkiRequest-mobile"
-      v-if="isSmallDisplay"
+      v-if="isSmallDisplay && request.tag === PkiEnrollmentListItemTag.Valid"
     >
       <div class="pkiRequest-mobile-header">
-        <ion-text class="pkiRequest-mobile-header__name subtitles-normal">{{ request.humanHandle.label }}</ion-text>
-        <ion-text class="pkiRequest-mobile-header__email button-medium">{{ request.humanHandle.email }}</ion-text>
+        <ion-text class="pkiRequest-mobile-header__name subtitles-normal">
+          {{ (request as PkiEnrollmentListItemValid).payload.humanHandle.label }}
+        </ion-text>
+        <ion-text class="pkiRequest-mobile-header__email button-medium">
+          {{ (request as PkiEnrollmentListItemValid).payload.humanHandle.email }}
+        </ion-text>
       </div>
       <div class="pkiRequest-mobile-content">
         <ion-text class="pkiRequest-mobile-content__createdOn body-sm">
-          {{ $msTranslate(formatTimeSince(request.createdOn, '--', 'short')) }}
+          {{ $msTranslate(formatTimeSince(request.submittedOn, '--', 'short')) }}
         </ion-text>
-        <div
-          class="certificate button-small"
-          :class="`certificate-${request.validity}`"
-        >
+        <div class="certificate button-small certificate-valid">
           <ion-icon
             :icon="validity.icon"
             class="certificate-icon"
@@ -35,12 +36,12 @@
     <!-- request avatar -->
     <div
       class="pkiRequest-name"
-      v-if="isLargeDisplay"
+      v-if="isLargeDisplay && request.tag === PkiEnrollmentListItemTag.Valid"
     >
       <ion-text class="pkiRequest-name__label cell">
         <user-avatar-name
-          :user-avatar="request.humanHandle.label"
-          :user-name="request.humanHandle.label"
+          :user-avatar="(request as PkiEnrollmentListItemValid).payload.humanHandle.label"
+          :user-name="(request as PkiEnrollmentListItemValid).payload.humanHandle.label"
         />
       </ion-text>
     </div>
@@ -48,10 +49,10 @@
     <!-- request mail -->
     <div
       class="pkiRequest-email"
-      v-if="isLargeDisplay"
+      v-if="isLargeDisplay && request.tag === PkiEnrollmentListItemTag.Valid"
     >
       <ion-text class="pkiRequest-email__label cell">
-        {{ request.humanHandle.email }}
+        {{ (request as PkiEnrollmentListItemValid).payload.humanHandle.email }}
       </ion-text>
     </div>
 
@@ -61,20 +62,17 @@
       v-if="isLargeDisplay"
     >
       <ion-text class="pkiRequest-createdOn__label cell">
-        {{ $msTranslate(formatTimeSince(request.createdOn, '--', 'short')) }}
+        {{ $msTranslate(formatTimeSince(request.submittedOn, '--', 'short')) }}
       </ion-text>
     </div>
 
     <!-- request certificate -->
     <div
       class="pkiRequest-certificate"
-      v-if="isLargeDisplay"
+      v-if="isLargeDisplay && request.tag === PkiEnrollmentListItemTag.Valid"
     >
       <ion-text class="pkiRequest-certificate__label cell">
-        <div
-          class="certificate button-small"
-          :class="`certificate-${request.validity}`"
-        >
+        <div class="certificate button-small certificate-valid">
           <ion-icon
             :icon="validity.icon"
             class="certificate-icon"
@@ -112,9 +110,9 @@
 
 <script setup lang="ts">
 import UserAvatarName from '@/components/users/UserAvatarName.vue';
-import { JoinRequestValidity, OrganizationJoinRequest } from '@/parsec';
+import { PkiEnrollmentListItem, PkiEnrollmentListItemTag, PkiEnrollmentListItemValid } from '@/parsec';
 import { IonButton, IonIcon, IonItem, IonText } from '@ionic/vue';
-import { checkmarkCircle, closeCircle, warning } from 'ionicons/icons';
+import { checkmarkCircle, closeCircle } from 'ionicons/icons';
 import { attachMouseOverTooltip, formatTimeSince, useWindowSize } from 'megashark-lib';
 import { computed, onMounted, useTemplateRef } from 'vue';
 
@@ -122,21 +120,19 @@ const { isSmallDisplay, isLargeDisplay } = useWindowSize();
 const rejectButtonRef = useTemplateRef<InstanceType<typeof IonButton>>('rejectButton');
 
 const props = defineProps<{
-  request: OrganizationJoinRequest;
+  request: PkiEnrollmentListItem;
 }>();
 
 defineEmits<{
-  (e: 'acceptClick', invitation: OrganizationJoinRequest): void;
-  (e: 'rejectClick', invitation: OrganizationJoinRequest): void;
+  (e: 'acceptClick', invitation: PkiEnrollmentListItem): void;
+  (e: 'rejectClick', invitation: PkiEnrollmentListItem): void;
 }>();
 
 const validity = computed(() => {
-  if (props.request.validity === JoinRequestValidity.Valid) {
+  if (props.request.tag === PkiEnrollmentListItemTag.Valid) {
     return { text: 'InvitationsPage.pkiRequests.certificate.valid', icon: checkmarkCircle };
-  } else if (props.request.validity === JoinRequestValidity.Invalid) {
-    return { text: 'InvitationsPage.pkiRequests.certificate.invalid', icon: closeCircle };
   } else {
-    return { text: 'InvitationsPage.pkiRequests.certificate.unknown', icon: warning };
+    return { text: 'InvitationsPage.pkiRequests.certificate.invalid', icon: closeCircle };
   }
 });
 
diff --git a/client/src/components/organizations/OrganizationPkiRequest.vue b/client/src/components/organizations/OrganizationPkiRequest.vue
index 85880bf0180..6da78d15cb8 100644
--- a/client/src/components/organizations/OrganizationPkiRequest.vue
+++ b/client/src/components/organizations/OrganizationPkiRequest.vue
@@ -3,29 +3,39 @@
 <template>
   <div
     class="organization-request"
-    :class="request.status"
+    :class="{
+      pending: request.info.tag === PKIInfoItemTag.Submitted,
+      rejected: request.info.tag === PKIInfoItemTag.Rejected,
+      accepted: request.info.tag === PKIInfoItemTag.Accepted,
+      cancelled: request.info.tag === PKIInfoItemTag.Cancelled,
+    }"
   >
     <ion-card-content class="organization-request-content">
       <div class="organization-request-info">
-        <ion-text class="organization-request-organization title-h4">{{ request.organization }}</ion-text>
-        <ion-text class="organization-request-username body">{{ request.humanHandle.label }}</ion-text>
+        <ion-text class="organization-request-organization title-h4">{{ addr?.organizationId ?? '' }}</ion-text>
+        <ion-text class="organization-request-username body">{{ request.enrollment.payload.humanHandle.label }}</ion-text>
       </div>
       <div class="organization-request-status-container">
         <ion-text
           class="organization-request-status button-small"
-          :class="`status-${request.status}`"
-          ref="statusText"
+          :class="{
+            'status-pending': request.info.tag === PKIInfoItemTag.Submitted,
+            'status-rejected': request.info.tag === PKIInfoItemTag.Rejected,
+            'status-accepted': request.info.tag === PKIInfoItemTag.Accepted,
+            'status-cancelled': request.info.tag === PKIInfoItemTag.Cancelled,
+          }"
+          ref="statusTextEl"
         >
           <span v-if="statusText">{{ $msTranslate(statusText) }}</span>
         </ion-text>
         <ion-icon
-          v-if="request.status !== JoinRequestStatus.Accepted"
+          v-if="request.info.tag !== PKIInfoItemTag.Accepted"
           @click="$emit('deleteRequest', request)"
           :icon="closeCircle"
           class="organization-request-icon"
         />
         <ion-button
-          v-if="request.status === JoinRequestStatus.Accepted"
+          v-if="request.info.tag === PKIInfoItemTag.Accepted"
           fill="clear"
           class="organization-request-button"
           @click="$emit('joinOrganization', request)"
@@ -42,49 +52,61 @@
 </template>
 
 <script lang="ts" setup>
-import { JoinRequestStatus, LocalJoinRequest } from '@/parsec';
+import { ParsedParsecAddrPkiEnrollment, ParsedParsecAddrTag, parseParsecAddr, PKIInfoItemTag, PkiLocalRequest } from '@/parsec';
 import { IonButton, IonCardContent, IonIcon, IonText } from '@ionic/vue';
 import { arrowForward, closeCircle } from 'ionicons/icons';
 import { attachMouseOverTooltip } from 'megashark-lib';
-import { computed, onMounted, useTemplateRef, watch } from 'vue';
+import { computed, onMounted, ref, useTemplateRef, watch } from 'vue';
 
-const statusTextRef = useTemplateRef<InstanceType<typeof IonText>>('statusText');
+const statusTextRef = useTemplateRef<InstanceType<typeof IonText>>('statusTextEl');
+const addr = ref<ParsedParsecAddrPkiEnrollment | undefined>(undefined);
 
 const props = defineProps<{
-  request: LocalJoinRequest;
+  request: PkiLocalRequest;
 }>();
 
 onMounted(async () => {
-  if (statusTextRef.value && props.request.status === JoinRequestStatus.Pending) {
-    attachMouseOverTooltip(statusTextRef.value.$el, 'HomePage.organizationRequest.pending.tooltip');
-  } else if (statusTextRef.value && props.request.status === JoinRequestStatus.Rejected) {
-    attachMouseOverTooltip(statusTextRef.value.$el, 'HomePage.organizationRequest.rejected.tooltip');
+  attachTooltip(statusTextRef.value?.$el, props.request.info.tag);
+  const addrResult = await parseParsecAddr(props.request.enrollment.addr);
+  if (addrResult.ok && addrResult.value.tag === ParsedParsecAddrTag.PkiEnrollment) {
+    addr.value = addrResult.value;
   }
 });
 
 watch(
-  () => props.request.status,
+  () => props.request.info.tag,
   (newStatus) => {
-    if (statusTextRef.value && newStatus === JoinRequestStatus.Pending) {
-      attachMouseOverTooltip(statusTextRef.value.$el, 'HomePage.organizationRequest.pending.tooltip');
-    } else if (statusTextRef.value && newStatus === JoinRequestStatus.Rejected) {
-      attachMouseOverTooltip(statusTextRef.value.$el, 'HomePage.organizationRequest.rejected.tooltip');
-    }
+    attachTooltip(statusTextRef.value?.$el, newStatus);
   },
 );
 
+function attachTooltip(el: HTMLElement | undefined, status: PKIInfoItemTag): void {
+  if (!el) {
+    return;
+  }
+  if (status === PKIInfoItemTag.Submitted) {
+    attachMouseOverTooltip(el, 'HomePage.organizationRequest.pending.tooltip');
+  } else if (status === PKIInfoItemTag.Rejected) {
+    attachMouseOverTooltip(el, 'HomePage.organizationRequest.rejected.tooltip');
+  } else if (status === PKIInfoItemTag.Cancelled) {
+    attachMouseOverTooltip(el, 'HomePage.organizationRequest.cancelled.tooltip');
+  } else if (status === PKIInfoItemTag.Accepted) {
+    attachMouseOverTooltip(el, 'HomePage.organizationRequest.accepted.tooltip');
+  }
+}
+
 defineEmits<{
-  (e: 'joinOrganization', request: LocalJoinRequest): void;
-  (e: 'deleteRequest', request: LocalJoinRequest): void;
+  (e: 'joinOrganization', request: PkiLocalRequest): void;
+  (e: 'deleteRequest', request: PkiLocalRequest): void;
 }>();
 
 const statusText = computed(() => {
-  switch (props.request.status) {
-    case JoinRequestStatus.Pending:
+  switch (props.request.info.tag) {
+    case PKIInfoItemTag.Submitted:
       return 'HomePage.organizationRequest.status.pending';
-    case JoinRequestStatus.Rejected:
+    case PKIInfoItemTag.Rejected:
       return 'HomePage.organizationRequest.status.rejected';
-    case JoinRequestStatus.Cancelled:
+    case PKIInfoItemTag.Cancelled:
       return 'HomePage.organizationRequest.status.cancelled';
     default:
       return undefined;
@@ -149,16 +171,20 @@ const statusText = computed(() => {
       padding: 0.125rem 0.5rem;
       flex-shrink: 0;
 
-      &.status-pending {
+      &.status-cancelled {
         background-color: var(--parsec-color-light-secondary-grey);
         color: var(--parsec-color-light-secondary-white);
       }
 
-      &.status-rejected,
-      &.status-cancelled {
+      &.status-rejected {
         background-color: var(--parsec-color-light-danger-500);
         color: var(--parsec-color-light-secondary-white);
       }
+
+      &.status-pending {
+        background-color: var(--parsec-color-light-warning-100);
+        color: var(--parsec-color-light-warning-700);
+      }
     }
 
     .organization-request-icon {
@@ -205,7 +231,7 @@ const statusText = computed(() => {
     border-color: var(--parsec-color-light-secondary-light);
 
     .organization-request-icon {
-      color: var(--parsec-color-light-secondary-light);
+      color: var(--parsec-color-light-secondary-grey);
 
       &:hover {
         color: var(--parsec-color-light-secondary-text);
diff --git a/client/src/components/users/UserInformation.vue b/client/src/components/users/UserInformation.vue
index 9147813a784..b7f42597265 100644
--- a/client/src/components/users/UserInformation.vue
+++ b/client/src/components/users/UserInformation.vue
@@ -64,12 +64,22 @@ defineExpose({
   email,
   fullName,
   setFocus,
+  getEmail,
+  getFullName,
 });
 
 async function setFocus(): Promise<void> {
   await firstInputFieldRef.value?.setFocus();
 }
 
+function getEmail(): string {
+  return email.value;
+}
+
+function getFullName(): string {
+  return fullName.value;
+}
+
 async function areFieldsCorrect(): Promise<boolean> {
   return (
     (await emailValidator(email.value)).validity === Validity.Valid && (await userNameValidator(fullName.value)).validity === Validity.Valid
diff --git a/client/src/locales/en-US.json b/client/src/locales/en-US.json
index 542ec8cb9bc..85ba76031ba 100644
--- a/client/src/locales/en-US.json
+++ b/client/src/locales/en-US.json
@@ -316,16 +316,23 @@
         "lostDevice": "Lost your access?",
         "recoverDevice": "Recover my session",
         "organizationRequest": {
+            "notAvailable": "Requests to join an organization using a certificate is not yet supported on your system.",
             "title": "Pending requests",
             "status": {
                 "pending": "Pending",
-                "rejected": "Rejected"
+                "rejected": "Rejected",
+                "cancelled": "Cancelled"
             },
             "requestSent": {
                 "success": "Your request to join the organization has been sent.",
-                "failure": "Failed to send the request. Please try again later."
+                "failure": "Failed to send the request. Please try again later.",
+                "emailUsed": "This email is already used.",
+                "alreadyEnrolled": "A user with this certificate is already a member of this organization.",
+                "alreadySubmitted": "A request has already been made with this certificate.",
+                "offline": "Cannot contact the server. Please check your internet connection."
             },
             "requestCancelled": "Your request to join the organization has been cancelled.",
+            "requestCancelError": "Could not cancel the request.",
             "requestDeleted": "Your request to join the organization has been deleted.",
             "joinButton": "Join",
             "pending": {
@@ -344,7 +351,11 @@
             },
             "accepted": {
                 "joinSuccess": "You successfully joined the organization.",
-                "joinFailure": "Failed to join the organization. Please try again later."
+                "joinFailure": "Failed to join the organization. Please try again later.",
+                "tooltip": "Your request to join this organization has been accepted by an Administrator."
+            },
+            "cancelled": {
+                "tooltip": "Your request to join this organization has been cancelled."
             }
         }
     },
@@ -1331,7 +1342,23 @@
         "cancelConfirm": "Cancel the onboarding",
         "cancelConfirmSubtitle": "Are you sure you want to cancel the onboarding process? Information will not be saved, you will have to restart.",
         "cancelYes": "Cancel process",
-        "cancelNo": "Resume"
+        "cancelNo": "Resume",
+        "joinPkiModal": {
+            "title": "Join organization with Smartcard",
+            "certificate": {
+                "label": "Certificate selection",
+                "addButton": "Add a certificate",
+                "updateButton": "Update",
+                "selected": "Certificate selected",
+                "description": "Certificate verified your identity and allows you to securely join the organization."
+            },
+            "notAvailable": "Smartcard is not available on this system.",
+            "buttons": {
+                "join": "Request to join organization",
+                "cancel": "Cancel",
+                "close": "Close"
+            }
+        }
     },
     "UsersPage": {
         "listDisplayTitles": {
@@ -1589,11 +1616,20 @@
             }
         },
         "pkiRequests": {
+            "invalidityReasons": {
+                "expired": "The provided certificate is expired.",
+                "noInfo": "Could not get any information in the certificate.",
+                "noRootCertificate": "Could not find a root certificate matching the provided certificate.",
+                "untrusted": "This certificate cannot be trusted.",
+                "generic": "This certificate is invalid."
+            },
             "tab": "PKI requests",
             "tabShort": "PKI",
             "emptyState": "No pending PKI requests.",
             "copyLink": "Copy link (PKI)",
-            "pkiFeature": "This feature requires a PKI (Public Key Infrastructure).",
+            "notAvailable": "Unavailable",
+            "pkiFeature": "The PKI feature required a PKI infrastructure to be used.",
+            "invalidRequest": "Invalid PKI request",
             "listDisplayTitles": {
                 "name": "Name",
                 "email": "Email",
@@ -1607,10 +1643,10 @@
                 "unknown": "Unknown"
             },
             "rootCertificate": {
-                "missingCertificateTitle": "Missing root certificate",
-                "missingCertificateDescription": "A root certificate is required to validate PKI join requests. For security reasons, the certificate is not stored, and must be provided each time you login to the organization.",
-                "setRootCertificate": "Set root certificate",
-                "updateRootCertificate": "Update root certificate"
+                "missingCertificateTitle": "Missing your certificate",
+                "missingCertificateDescription": "A certificate is required to validate requests received by PKI. For security reasons, the certificate must be provided each time the organization is reopened.",
+                "setRootCertificate": "Set your certificate",
+                "updateRootCertificate": "Update your certificate"
             },
             "validationModal": {
                 "error": {
diff --git a/client/src/locales/fr-FR.json b/client/src/locales/fr-FR.json
index d8c3cf76950..477199da0bf 100644
--- a/client/src/locales/fr-FR.json
+++ b/client/src/locales/fr-FR.json
@@ -315,16 +315,23 @@
         "lostDevice": "Vous avez perdu votre accès ?",
         "recoverDevice": "Récupérer ma session",
         "organizationRequest": {
+            "notAvailable": "Les requêtes pour rejoindre une organisation en utilisant un certificat ne sont pas encore disponibles sur votre système.",
             "title": "Demandes en attente",
             "status": {
                 "pending": "En attente",
-                "rejected": "Rejetée"
+                "rejected": "Rejetée",
+                "cancelled": "Annulée"
             },
             "requestSent": {
                 "success": "Votre demande pour rejoindre l'organisation a été envoyée.",
-                "failure": "Échec de l'envoi de la demande. Veuillez réessayer plus tard."
+                "failure": "Échec de l'envoi de la demande. Veuillez réessayer plus tard.",
+                "emailUsed": "Cet email est déjà utilisé.",
+                "alreadyEnrolled": "Un utilisateur avec ce certificat est déjà membre de l'organisation.",
+                "alreadySubmitted": "Une requête pour rejoindre l'organisation a déjà été soumise avec ce certificat.",
+                "offline": "Impossible de contacter le serveur. Veuillez vérifier que vous êtes connecté(e) à Internet."
             },
             "requestCancelled": "Votre demande pour rejoindre l'organisation a bien été annulée.",
+            "requestCancelError": "Impossible d'annuler la requête.",
             "requestDeleted": "Votre demande pour rejoindre l'organisation a bien été supprimée.",
             "joinButton": "Rejoindre",
             "pending": {
@@ -343,7 +350,11 @@
             },
             "accepted": {
                 "joinSuccess": "Vous avez rejoint l'organisation avec succès.",
-                "joinFailure": "Échec de l'adhésion à l'organisation. Veuillez réessayer plus tard."
+                "joinFailure": "Échec de l'adhésion à l'organisation. Veuillez réessayer plus tard.",
+                "tooltip": "Votre demande pour rejoindre cette organisation a été acceptée par un administrateur."
+            },
+            "cancelled": {
+                "tooltip": "Votre demande pour rejoindre cette organisation a été annulée."
             }
         }
     },
@@ -1330,7 +1341,23 @@
         "cancelConfirm": "Annulation",
         "cancelConfirmSubtitle": "Êtes-vous sûr(e) de vouloir annuler le processus ? Les informations ne seront pas sauvegardées, vous devrez reprendre depuis le debut.",
         "cancelYes": "Annuler le processus",
-        "cancelNo": "Reprendre"
+        "cancelNo": "Reprendre",
+        "joinPkiModal": {
+            "title": "Rejoindre avec une carte à puce",
+            "certificate": {
+                "label": "Sélection du certificat",
+                "addButton": "Ajouter un certificat",
+                "updateButton": "Mettre à jour",
+                "selected": "Certificat sélectionné",
+                "description": "Le certificat vérifie votre identité et vous permet de rejoindre l'organisation en toute sécurité."
+            },
+            "notAvailable": "La carte à puce n'est pas disponible sur ce système.",
+            "buttons": {
+                "join": "Demander à rejoindre l'organisation",
+                "cancel": "Annuler",
+                "close": "Fermer"
+            }
+        }
     },
     "UsersPage": {
         "listDisplayTitles": {
@@ -1588,11 +1615,20 @@
             }
         },
         "pkiRequests": {
+            "invalidityReasons": {
+                "expired": "Le certificat fourni a expiré.",
+                "noInfo": "Impossible d'obtenir des informations sur le certificat.",
+                "noRootCertificate": "Aucun certificat racine correspond au certificat fourni.",
+                "untrusted": "Impossible de faire confiance à ce certificat.",
+                "generic": "Le certificat est invalide."
+            },
             "tab": "Demandes par PKI",
             "tabShort": "PKI",
             "emptyState": "Aucune demande PKI en attente.",
             "copyLink": "Copier le lien (PKI)",
-            "pkiFeature": "Cette fonctionnalité nécessite une PKI (Infrastructure à clés publiques).",
+            "notAvailable": "Non disponible",
+            "pkiFeature": "La fonctionnalité PKI nécessite une infrastructure PKI pour être utilisée.",
+            "invalidRequest": "Demande PKI invalide",
             "listDisplayTitles": {
                 "name": "Nom",
                 "email": "Email",
diff --git a/client/src/main.ts b/client/src/main.ts
index e564fa83123..0e0fce9c40a 100644
--- a/client/src/main.ts
+++ b/client/src/main.ts
@@ -48,6 +48,8 @@ enum AppState {
   Initializing = 'initializing',
 }
 
+(window as any).TESTING_PKI = true;
+
 async function parsecEventCallback(handle: ConnectionHandle, event: ClientEvent): Promise<void> {
   const injections = injectionProvider.getInjections(handle);
   // Event might fire a bit to fast, before we get a chance to create the injections for this handle
diff --git a/client/src/parsec/pki.ts b/client/src/parsec/pki.ts
index 4d028261bf3..d03102f3179 100644
--- a/client/src/parsec/pki.ts
+++ b/client/src/parsec/pki.ts
@@ -1,310 +1,499 @@
 // Parsec Cloud (https://parsec.cloud) Copyright (c) BUSL-1.1 2016-present Scille SAS
 
 import { getDefaultDeviceName } from '@/common/device';
-import { getClientInfo } from '@/parsec/login';
-import { getOrganizationInfo, parseParsecAddr } from '@/parsec/organization';
+import { getClientConfig } from '@/parsec/internals';
+import { SaveStrategy } from '@/parsec/login';
 import {
   AvailableDevice,
   AvailableDeviceTypeTag,
   HumanHandle,
-  OrganizationID,
-  ParsecAddr,
+  ListPkiLocalPendingError,
   ParsecOrganizationAddr,
+  ParsecPkiEnrollmentAddr,
+  PkiEnrollmentAcceptError,
+  PkiEnrollmentFinalizeError,
+  PkiEnrollmentFinalizeErrorTag,
+  PkiEnrollmentListError,
+  PkiEnrollmentListItem,
+  PkiEnrollmentListItemTag,
+  PkiEnrollmentListItemValid,
+  PkiEnrollmentRejectError,
+  PkiEnrollmentSubmitError,
+  PkiEnrollmentSubmitPayload,
+  PkiGetAddrError,
+  PKIInfoItemTag,
+  PkiLocalRequest,
+  RemoveDeviceError,
   Result,
   ShowCertificateSelectionDialogError,
   ShowCertificateSelectionDialogErrorTag,
   UserProfile,
   X509CertificateReference,
 } from '@/parsec/types';
-import { libparsec } from '@/plugins/libparsec';
+import { generateNoHandleError } from '@/parsec/utils';
+import { InvalidityReasonTag, libparsec, X509URIFlavorValueTag } from '@/plugins/libparsec';
+import { getConnectionHandle } from '@/router';
 import { DateTime } from 'luxon';
 
-/*
- * This is all mocked to be able to progress the GUI side without the bindings.
- */
-
-export enum JoinRequestStatus {
-  Pending = 'pending',
-  Accepted = 'accepted',
-  Rejected = 'rejected',
-  Cancelled = 'cancelled',
-}
-
-export enum JoinRequestValidity {
-  Unknown = 'unknown',
-  Valid = 'valid',
-  Invalid = 'invalid',
-}
+const _PKI_PARSEC_API = {
+  async requestJoinOrganization(
+    certificate: X509CertificateReference,
+    humanHandle: HumanHandle,
+    link: ParsecOrganizationAddr,
+  ): Promise<Result<null, PkiEnrollmentSubmitError>> {
+    const result = await libparsec.pkiEnrollmentSubmit(getClientConfig(), link, certificate, humanHandle, getDefaultDeviceName(), false);
+    if (result.ok) {
+      return { ok: true, value: null };
+    }
+    return result;
+  },
 
-export interface LocalJoinRequest {
-  status: JoinRequestStatus;
-  humanHandle: HumanHandle;
-  organization: OrganizationID;
-  serverAddr: ParsecAddr;
-  certificate: string;
-}
+  async listLocalJoinRequests(): Promise<Result<Array<PkiLocalRequest>, ListPkiLocalPendingError>> {
+    const result = await libparsec.listPkiLocalPendingEnrollments(getClientConfig().configDir);
 
-export enum RequestJoinOrganizationErrorTag {
-  Internal = 'internal',
-}
+    if (!result.ok) {
+      return result;
+    }
+    const list: Array<PkiLocalRequest> = [];
+    for (const enrollment of result.value) {
+      enrollment.submittedOn = DateTime.fromSeconds(enrollment.submittedOn as any as number);
+      const infoResult = await libparsec.pkiEnrollmentInfo(getClientConfig(), enrollment.addr, enrollment.enrollmentId);
+      if (infoResult.ok) {
+        infoResult.value.submittedOn = DateTime.fromSeconds(infoResult.value.submittedOn as any as number);
+        if (infoResult.value.tag === PKIInfoItemTag.Accepted) {
+          infoResult.value.acceptedOn = DateTime.fromSeconds(infoResult.value.acceptedOn as any as number);
+        } else if (infoResult.value.tag === PKIInfoItemTag.Cancelled) {
+          infoResult.value.cancelledOn = DateTime.fromSeconds(infoResult.value.cancelledOn as any as number);
+        } else if (infoResult.value.tag === PKIInfoItemTag.Rejected) {
+          infoResult.value.rejectedOn = DateTime.fromSeconds(infoResult.value.rejectedOn as any as number);
+        }
+        list.push({ info: infoResult.value, enrollment: enrollment });
+      }
+    }
+    return { ok: true, value: list };
+  },
 
-export interface RequestJoinOrganizationError {
-  tag: RequestJoinOrganizationErrorTag;
-  error: string;
-}
+  async confirmLocalJoinRequest(request: PkiLocalRequest): Promise<Result<AvailableDevice, PkiEnrollmentFinalizeError>> {
+    if (request.info.tag !== PKIInfoItemTag.Accepted) {
+      return {
+        ok: false,
+        error: {
+          tag: PkiEnrollmentFinalizeErrorTag.Internal,
+          error: `Invalid state: should be ${PKIInfoItemTag.Accepted} but is ${request.info.tag}`,
+        },
+      };
+    }
+    (request.enrollment.submittedOn as any as number) = request.enrollment.submittedOn.toSeconds();
+    (request.info.submittedOn as any as number) = request.info.submittedOn.toSeconds();
+    (request.info.acceptedOn as any as number) = request.info.acceptedOn.toSeconds();
+    return await libparsec.pkiEnrollmentFinalize(
+      getClientConfig(),
+      SaveStrategy.useSmartCard(request.enrollment.certRef),
+      request.info.answer,
+      request.enrollment,
+    );
+  },
+
+  async cancelLocalJoinRequest(request: PkiLocalRequest): Promise<Result<null, RemoveDeviceError>> {
+    return await libparsec.pkiRemoveLocalPending(getClientConfig(), request.enrollment.enrollmentId);
+  },
+
+  async listOrganizationJoinRequests(): Promise<Result<Array<PkiEnrollmentListItem>, PkiEnrollmentListError>> {
+    const handle = getConnectionHandle();
+
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentListError>();
+    }
 
-export interface OrganizationJoinRequest {
-  humanHandle: HumanHandle;
-  certificate: string;
-  createdOn: DateTime;
-  validity: JoinRequestValidity;
-}
+    const result = await libparsec.clientPkiListEnrollments(handle);
+    if (result.ok) {
+      result.value = result.value.map((item) => {
+        item.submittedOn = DateTime.fromSeconds(item.submittedOn as any as number);
+        return item;
+      });
+    }
+    return result;
+  },
 
-export enum ListLocalJoinRequestErrorTag {
-  Internal = 'internal',
-}
+  async getPkiJoinOrganizationLink(): Promise<Result<ParsecPkiEnrollmentAddr, PkiGetAddrError>> {
+    const handle = getConnectionHandle();
 
-interface ListLocalJoinRequestError {
-  tag: ListLocalJoinRequestErrorTag;
-  error: string;
-}
+    if (!handle) {
+      return generateNoHandleError<PkiGetAddrError>();
+    }
 
-export enum ListOrganizationJoinRequestErrorTag {
-  Internal = 'internal',
-}
+    return await libparsec.clientPkiGetAddr(handle);
+  },
 
-interface ListOrganizationJoinRequestError {
-  tag: ListOrganizationJoinRequestErrorTag;
-  error: string;
-}
+  async acceptOrganizationJoinRequest(
+    request: PkiEnrollmentListItemValid,
+    profile: UserProfile,
+    adminCert: X509CertificateReference,
+  ): Promise<Result<null, PkiEnrollmentAcceptError>> {
+    const handle = getConnectionHandle();
 
-export enum UpdateLocalJoinStatusErrorTag {
-  Internal = 'internal',
-  InvalidStatus = 'invalid-status',
-  NotFound = 'not-found',
-}
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentAcceptError>();
+    }
+    return await libparsec.clientPkiEnrollmentAccept(
+      handle,
+      profile,
+      request.enrollmentId,
+      request.payload.humanHandle,
+      adminCert,
+      request.payload,
+    );
+  },
+
+  async rejectOrganizationJoinRequest(request: PkiEnrollmentListItem): Promise<Result<null, PkiEnrollmentRejectError>> {
+    const handle = getConnectionHandle();
+
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentRejectError>();
+    }
+    return await libparsec.clientPkiEnrollmentReject(handle, request.enrollmentId);
+  },
 
-interface UpdateLocalJoinStatusError {
-  tag: UpdateLocalJoinStatusErrorTag;
-  error: string;
-}
+  async selectCertificate(): Promise<Result<X509CertificateReference | undefined, ShowCertificateSelectionDialogError>> {
+    if (!(await this.isSmartcardAvailable())) {
+      return { ok: false, error: { tag: ShowCertificateSelectionDialogErrorTag.CannotOpenStore, error: 'smartcard not available' } };
+    }
+    const result = await libparsec.showCertificateSelectionDialogWindowsOnly();
+    if (result.ok && result.value === null) {
+      return { ok: true, value: undefined };
+    }
+    return result as Result<X509CertificateReference | undefined, ShowCertificateSelectionDialogError>;
+  },
+
+  async isSmartcardAvailable(): Promise<boolean> {
+    return await libparsec.isPkiAvailable();
+  },
+};
+
+const _PKI_MOCKED_API = {
+  async requestJoinOrganization(
+    _certificate: X509CertificateReference,
+    _humanHandle: HumanHandle,
+    _link: ParsecOrganizationAddr,
+  ): Promise<Result<null, PkiEnrollmentSubmitError>> {
+    return { ok: true, value: null };
+  },
+
+  async listLocalJoinRequests(): Promise<Result<Array<PkiLocalRequest>, ListPkiLocalPendingError>> {
+    const PAYLOAD: PkiEnrollmentSubmitPayload = {
+      verifyKey: new Uint8Array(),
+      publicKey: new Uint8Array(),
+      deviceLabel: 'Label',
+      humanHandle: {
+        label: 'Gordon Freeman',
+        email: 'gordon.freeman@blackmesa.nm',
+      },
+    };
+
+    const REQUESTS: Array<PkiLocalRequest> = [
+      {
+        info: {
+          tag: PKIInfoItemTag.Accepted,
+          answer: {
+            userId: 'userId1',
+            deviceId: 'deviceId1',
+            deviceLabel: 'Label1',
+            humanHandle: {
+              label: 'Gordon Freeman',
+              email: 'gordon.freeman@blackmesa.nm',
+            },
+            profile: UserProfile.Standard,
+            rootVerifyKey: new Uint8Array(),
+          },
+          submittedOn: DateTime.utc(),
+          acceptedOn: DateTime.utc(),
+        },
+        enrollment: {
+          certRef: {
+            uris: [
+              {
+                tag: X509URIFlavorValueTag.WindowsCNG,
+                x1: new Uint8Array(),
+              },
+            ],
+            hash: 'abcd1',
+          },
+          addr: 'parsec3://localhost:6770/BlackMesa?no_ssl=true&a=pki_enrollment',
+          submittedOn: DateTime.utc(),
+          enrollmentId: '1',
+          payload: PAYLOAD,
+          encryptedKey: new Uint8Array(),
+          encryptedKeyAlgo: 'algorithm',
+          ciphertext: new Uint8Array(),
+        },
+      },
+      {
+        info: {
+          tag: PKIInfoItemTag.Cancelled,
+          submittedOn: DateTime.utc(),
+          cancelledOn: DateTime.utc(),
+        },
+        enrollment: {
+          certRef: {
+            uris: [
+              {
+                tag: X509URIFlavorValueTag.WindowsCNG,
+                x1: new Uint8Array(),
+              },
+            ],
+            hash: 'abcd2',
+          },
+          addr: 'parsec3://localhost:6770/BlackMesa?no_ssl=true&a=pki_enrollment',
+          submittedOn: DateTime.utc(),
+          enrollmentId: '2',
+          payload: PAYLOAD,
+          encryptedKey: new Uint8Array(),
+          encryptedKeyAlgo: 'algorithm',
+          ciphertext: new Uint8Array(),
+        },
+      },
+      {
+        info: {
+          tag: PKIInfoItemTag.Rejected,
+          submittedOn: DateTime.utc(),
+          rejectedOn: DateTime.utc(),
+        },
+        enrollment: {
+          certRef: {
+            uris: [
+              {
+                tag: X509URIFlavorValueTag.WindowsCNG,
+                x1: new Uint8Array(),
+              },
+            ],
+            hash: 'abcd3',
+          },
+          addr: 'parsec3://localhost:6770/BlackMesa?no_ssl=true&a=pki_enrollment',
+          submittedOn: DateTime.utc(),
+          enrollmentId: '3',
+          payload: PAYLOAD,
+          encryptedKey: new Uint8Array(),
+          encryptedKeyAlgo: 'algorithm',
+          ciphertext: new Uint8Array(),
+        },
+      },
+      {
+        info: {
+          tag: PKIInfoItemTag.Submitted,
+          submittedOn: DateTime.utc(),
+        },
+        enrollment: {
+          certRef: {
+            uris: [
+              {
+                tag: X509URIFlavorValueTag.WindowsCNG,
+                x1: new Uint8Array(),
+              },
+            ],
+            hash: 'abcd4',
+          },
+          addr: 'parsec3://localhost:6770/BlackMesa?no_ssl=true&a=pki_enrollment',
+          submittedOn: DateTime.utc(),
+          enrollmentId: '4',
+          payload: PAYLOAD,
+          encryptedKey: new Uint8Array(),
+          encryptedKeyAlgo: 'algorithm',
+          ciphertext: new Uint8Array(),
+        },
+      },
+    ];
 
-export enum UpdateOrganizationJoinStatusErrorTag {
-  Internal = 'internal',
-  InvalidStatus = 'invalid-status',
-  NotFound = 'not-found',
-  InsufficientPermissions = 'insufficient-permissions',
-}
+    return { ok: true, value: REQUESTS };
+  },
 
-interface UpdateOrganizationJoinStatusError {
-  tag: UpdateOrganizationJoinStatusErrorTag;
-  error: string;
-}
+  async confirmLocalJoinRequest(request: PkiLocalRequest): Promise<Result<AvailableDevice, PkiEnrollmentFinalizeError>> {
+    if (request.info.tag !== PKIInfoItemTag.Accepted) {
+      return {
+        ok: false,
+        error: {
+          tag: PkiEnrollmentFinalizeErrorTag.Internal,
+          error: `Invalid state: should be ${PKIInfoItemTag.Accepted} but is ${request.info.tag}`,
+        },
+      };
+    }
+    (request.enrollment.submittedOn as any as number) = request.enrollment.submittedOn.toSeconds();
+    (request.info.submittedOn as any as number) = request.info.submittedOn.toSeconds();
+    (request.info.acceptedOn as any as number) = request.info.acceptedOn.toSeconds();
+    return {
+      ok: true,
+      value: {
+        keyFilePath: '/keyfilepath',
+        createdOn: DateTime.utc(),
+        protectedOn: DateTime.utc(),
+        serverAddr: 'parsec3://localhost:6770?no_ssl=true',
+        organizationId: 'MyOrg',
+        userId: 'userId',
+        deviceId: 'deviceId',
+        humanHandle: {
+          label: 'Gordon Freeman',
+          email: 'gordon.freeman@blackmesa.nm',
+        },
+        deviceLabel: 'Label',
+        ty: {
+          tag: AvailableDeviceTypeTag.Smartcard,
+        },
+      },
+    };
+  },
 
-export enum ValidateOrganizationJoinRequestErrorTag {
-  Internal = 'internal',
-}
+  async cancelLocalJoinRequest(_request: PkiLocalRequest): Promise<Result<null, RemoveDeviceError>> {
+    return { ok: true, value: null };
+  },
 
-interface ValidateOrganizationJoinRequestError {
-  tag: ValidateOrganizationJoinRequestErrorTag;
-  error: string;
-}
+  async listOrganizationJoinRequests(): Promise<Result<Array<PkiEnrollmentListItem>, PkiEnrollmentListError>> {
+    const handle = getConnectionHandle();
 
-export enum GetPkiJoinOrganizationLinkErrorTag {
-  Internal = 'internal',
-}
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentListError>();
+    }
 
-interface GetPkiJoinOrganizationLinkError {
-  tag: GetPkiJoinOrganizationLinkErrorTag;
-  error: string;
-}
+    const ENROLLMENTS: Array<PkiEnrollmentListItem> = [
+      {
+        tag: PkiEnrollmentListItemTag.Invalid,
+        enrollmentId: '2',
+        submittedOn: DateTime.utc(),
+        reason: { tag: InvalidityReasonTag.Untrusted },
+        details: 'Cannot trust the certificate',
+      },
+      {
+        tag: PkiEnrollmentListItemTag.Valid,
+        enrollmentId: '1',
+        submittedOn: DateTime.utc(),
+        payload: {
+          verifyKey: new Uint8Array(),
+          publicKey: new Uint8Array(),
+          deviceLabel: 'Label',
+          humanHandle: {
+            label: 'Gordon Freeman',
+            email: 'gordon.freeman@blackmesa.nm',
+          },
+        },
+      },
+      {
+        tag: PkiEnrollmentListItemTag.Invalid,
+        enrollmentId: '2',
+        submittedOn: DateTime.utc(),
+        reason: { tag: InvalidityReasonTag.CannotOpenStore },
+        details: 'Could not open the certificate store',
+      },
+      {
+        tag: PkiEnrollmentListItemTag.Invalid,
+        enrollmentId: '3',
+        submittedOn: DateTime.utc(),
+        reason: { tag: InvalidityReasonTag.InvalidRootCertificate },
+        details: 'Could not open the certificate store',
+      },
+      {
+        tag: PkiEnrollmentListItemTag.Invalid,
+        enrollmentId: '4',
+        submittedOn: DateTime.utc(),
+        reason: { tag: InvalidityReasonTag.DateTimeOutOfRange },
+        details: 'Could not open the certificate store',
+      },
+      {
+        tag: PkiEnrollmentListItemTag.Invalid,
+        enrollmentId: '5',
+        submittedOn: DateTime.utc(),
+        reason: { tag: InvalidityReasonTag.CannotGetCertificateInfo },
+        details: 'Could not open the certificate store',
+      },
+    ];
 
-interface _Request {
-  humanHandle: HumanHandle;
-  certificate: string;
-  validity: JoinRequestValidity;
-  createdOn: DateTime;
-  organization: OrganizationID;
-  serverAddr: ParsecAddr;
-  status: JoinRequestStatus;
-}
+    return { ok: true, value: ENROLLMENTS };
+  },
 
-const REQUESTS: Array<_Request> = [];
+  async getPkiJoinOrganizationLink(): Promise<Result<ParsecPkiEnrollmentAddr, PkiGetAddrError>> {
+    const handle = getConnectionHandle();
 
-export async function requestJoinOrganization(
-  link: ParsecOrganizationAddr,
-): Promise<Result<LocalJoinRequest, RequestJoinOrganizationError>> {
-  const result = await parseParsecAddr(link);
-  if (!result.ok) {
-    throw new Error(`Invalid ParsecOrganizationAddr \`${link}\``);
-  }
-  const serverAddr = await libparsec.buildParsecAddr(result.value.hostname, result.value.port, result.value.useSsl);
-  // Will be prompted for the certificate
-  const newRequest: _Request = {
-    status: JoinRequestStatus.Pending,
-    validity: JoinRequestValidity.Unknown,
-    createdOn: DateTime.utc(),
-    humanHandle: {
-      // cspell:disable-next-line
-      label: 'Isaac Kleiner',
-      // cspell:disable-next-line
-      email: 'isaac.kleiner@blackmesa.nm',
-    },
-    organization: 'Black Mesa',
-    serverAddr,
-    certificate: '',
-  };
-  REQUESTS.push(newRequest);
-  return {
-    ok: true,
-    value: {
-      humanHandle: newRequest.humanHandle,
-      status: newRequest.status,
-      organization: newRequest.organization,
-      serverAddr: newRequest.serverAddr,
-      certificate: newRequest.certificate,
-    },
-  };
-}
+    if (!handle) {
+      return generateNoHandleError<PkiGetAddrError>();
+    }
 
-export async function listLocalJoinRequests(error = false): Promise<Result<Array<LocalJoinRequest>, ListLocalJoinRequestError>> {
-  if (error) {
-    return { ok: false, error: { tag: ListLocalJoinRequestErrorTag.Internal, error: 'generic error' } };
-  }
-  return {
-    ok: true,
-    value: REQUESTS.map((r) => {
-      return {
-        humanHandle: r.humanHandle,
-        status: r.status,
-        organization: r.organization,
-        serverAddr: r.serverAddr,
-        certificate: r.certificate,
-      };
-    }),
-  };
-}
+    return { ok: true, value: 'parsec3://localhost:6770/MyOrg?no_ssl=true&a=pki_enrollment' };
+  },
 
-export async function confirmLocalJoinRequest(request: LocalJoinRequest): Promise<Result<AvailableDevice, UpdateLocalJoinStatusError>> {
-  if (request.status !== JoinRequestStatus.Accepted) {
-    return { ok: false, error: { tag: UpdateLocalJoinStatusErrorTag.InvalidStatus, error: 'request not accepted' } };
-  }
-  const idx = REQUESTS.findIndex((r) => r.certificate === request.certificate);
-  if (idx === -1) {
-    return { ok: false, error: { tag: UpdateLocalJoinStatusErrorTag.NotFound, error: 'request does not exist' } };
-  }
-  REQUESTS.splice(idx, 1);
-  return {
-    ok: true,
-    value: {
-      keyFilePath: '/',
-      createdOn: DateTime.utc(),
-      protectedOn: DateTime.utc(),
-      serverAddr: request.serverAddr,
-      organizationId: request.organization,
-      userId: 'user_id',
-      deviceId: 'device_id',
-      humanHandle: {
-        label: request.humanHandle.label,
-        email: request.humanHandle.email,
-      },
-      deviceLabel: getDefaultDeviceName(),
-      ty: {
-        tag: AvailableDeviceTypeTag.Smartcard,
-      },
-    },
-  };
-}
+  async acceptOrganizationJoinRequest(
+    _request: PkiEnrollmentListItemValid,
+    _profile: UserProfile,
+    _adminCert: X509CertificateReference,
+  ): Promise<Result<null, PkiEnrollmentAcceptError>> {
+    const handle = getConnectionHandle();
 
-export async function cancelLocalJoinRequest(request: LocalJoinRequest): Promise<Result<null, UpdateLocalJoinStatusError>> {
-  const idx = REQUESTS.findIndex((r) => r.certificate === request.certificate);
-  if (idx === -1) {
-    return { ok: false, error: { tag: UpdateLocalJoinStatusErrorTag.NotFound, error: 'request does not exist' } };
-  }
-  REQUESTS.splice(idx, 1);
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentAcceptError>();
+    }
+    return { ok: true, value: null };
+  },
 
-  return { ok: true, value: null };
-}
+  async rejectOrganizationJoinRequest(_request: PkiEnrollmentListItem): Promise<Result<null, PkiEnrollmentRejectError>> {
+    const handle = getConnectionHandle();
 
-export async function listOrganizationJoinRequests(
-  rootCertificate?: string,
-  error = false,
-): Promise<Result<Array<OrganizationJoinRequest>, ListOrganizationJoinRequestError>> {
-  const joinRequests: OrganizationJoinRequest[] = [];
-  if (error) {
-    return { ok: false, error: { tag: ListOrganizationJoinRequestErrorTag.Internal, error: 'generic error' } };
-  }
-  if (!rootCertificate) {
-    return { ok: true, value: joinRequests };
-  } else {
-    const updated: Array<OrganizationJoinRequest> = [];
-    for (const jr of joinRequests) {
-      const result = await isValidOrganizationJoinRequest(rootCertificate, jr);
-      if (result.ok) {
-        updated.push({ ...jr, validity: result.value ? JoinRequestValidity.Valid : JoinRequestValidity.Invalid });
-      }
+    if (!handle) {
+      return generateNoHandleError<PkiEnrollmentRejectError>();
     }
-    return { ok: true, value: updated };
-  }
-}
-
-export async function acceptOrganizationJoinRequest(
-  request: OrganizationJoinRequest,
-  _profile: UserProfile,
-): Promise<Result<null, UpdateOrganizationJoinStatusError>> {
-  const joinRequests: OrganizationJoinRequest[] = [];
-  const idx = joinRequests.findIndex((r) => r.certificate === request.certificate);
-  if (idx === -1) {
-    return { ok: false, error: { tag: UpdateOrganizationJoinStatusErrorTag.NotFound, error: 'request does not exist' } };
-  }
-  const result = await getClientInfo();
-  if (!result.ok || result.value.currentProfile !== UserProfile.Admin) {
-    return { ok: false, error: { tag: UpdateOrganizationJoinStatusErrorTag.InsufficientPermissions, error: 'not admin' } };
-  }
-  joinRequests.splice(idx, 1);
-  return { ok: true, value: null };
-}
+    return { ok: true, value: null };
+  },
+
+  async selectCertificate(): Promise<Result<X509CertificateReference | undefined, ShowCertificateSelectionDialogError>> {
+    return {
+      ok: true,
+      value: {
+        uris: [
+          {
+            tag: X509URIFlavorValueTag.WindowsCNG,
+            x1: new Uint8Array(),
+          },
+        ],
+        hash: 'ijkl',
+      },
+    };
+  },
 
-export async function rejectOrganizationJoinRequest(
-  request: OrganizationJoinRequest,
-): Promise<Result<null, UpdateOrganizationJoinStatusError>> {
-  const joinRequests: OrganizationJoinRequest[] = [];
-  const idx = joinRequests.findIndex((r) => r.certificate === request.certificate);
-  if (idx === -1) {
-    return { ok: false, error: { tag: UpdateOrganizationJoinStatusErrorTag.NotFound, error: 'request does not exist' } };
-  }
-  const result = await getClientInfo();
-  if (!result.ok || result.value.currentProfile !== UserProfile.Admin) {
-    return { ok: false, error: { tag: UpdateOrganizationJoinStatusErrorTag.InsufficientPermissions, error: 'not admin' } };
-  }
-  return { ok: true, value: null };
-}
+  async isSmartcardAvailable(): Promise<boolean> {
+    return true;
+  },
+};
 
-export async function isValidOrganizationJoinRequest(
-  rootCertificate: string,
-  request: OrganizationJoinRequest,
-): Promise<Result<boolean, ValidateOrganizationJoinRequestError>> {
-  return { ok: true, value: rootCertificate.trim() === request.certificate.trim() };
-}
+// Some glue to switch between mocked and libparsec implementation
+// depending on a variable (useful for test/dev when not on Windows).
+type PkiImpl = typeof _PKI_PARSEC_API;
 
-export async function getPkiJoinOrganizationLink(): Promise<Result<string, GetPkiJoinOrganizationLinkError>> {
-  const result = await getOrganizationInfo();
-  if (!result.ok) {
-    return { ok: false, error: { tag: GetPkiJoinOrganizationLinkErrorTag.Internal, error: 'failed to get organization info' } };
-  }
-  if (result.value.organizationAddr.includes('?')) {
-    return { ok: true, value: `${result.value.organizationAddr}&a=pki_enrollment` };
+function pkiCurrentImpl(): PkiImpl {
+  if ((window as any).TESTING_PKI) {
+    return _PKI_MOCKED_API;
   }
-  return { ok: true, value: `${result.value.organizationAddr}?a=pki_enrollment` };
+  return _PKI_PARSEC_API;
 }
 
-export async function selectCertificate(): Promise<Result<X509CertificateReference | null, ShowCertificateSelectionDialogError>> {
-  if (!(await isSmartcardAvailable())) {
-    return { ok: false, error: { tag: ShowCertificateSelectionDialogErrorTag.CannotOpenStore, error: 'smartcard not available' } };
-  }
-  return await libparsec.showCertificateSelectionDialogWindowsOnly();
+function bind<K extends keyof PkiImpl>(key: K) {
+  return (...args: Parameters<PkiImpl[K]>) => (pkiCurrentImpl()[key] as any)(...args);
 }
 
-export async function isSmartcardAvailable(): Promise<boolean> {
-  return false;
-}
+const requestJoinOrganization = bind('requestJoinOrganization');
+const listLocalJoinRequests = bind('listLocalJoinRequests');
+const confirmLocalJoinRequest = bind('confirmLocalJoinRequest');
+const cancelLocalJoinRequest = bind('cancelLocalJoinRequest');
+const listOrganizationJoinRequests = bind('listOrganizationJoinRequests');
+const getPkiJoinOrganizationLink = bind('getPkiJoinOrganizationLink');
+const acceptOrganizationJoinRequest = bind('acceptOrganizationJoinRequest');
+const rejectOrganizationJoinRequest = bind('rejectOrganizationJoinRequest');
+const selectCertificate = bind('selectCertificate');
+const isSmartcardAvailable = bind('isSmartcardAvailable');
+
+export {
+  acceptOrganizationJoinRequest,
+  cancelLocalJoinRequest,
+  confirmLocalJoinRequest,
+  getPkiJoinOrganizationLink,
+  isSmartcardAvailable,
+  listLocalJoinRequests,
+  listOrganizationJoinRequests,
+  rejectOrganizationJoinRequest,
+  requestJoinOrganization,
+  selectCertificate,
+};
diff --git a/client/src/parsec/types.ts b/client/src/parsec/types.ts
index b47580ae26a..a08ab727443 100644
--- a/client/src/parsec/types.ts
+++ b/client/src/parsec/types.ts
@@ -53,6 +53,7 @@ export {
   GetServerConfigErrorTag,
   GreetInProgressErrorTag,
   ImportRecoveryDeviceErrorTag,
+  InvalidityReasonTag,
   InvitationEmailSentStatus,
   InvitationStatus,
   InviteListInvitationCreatedByTag,
@@ -63,6 +64,10 @@ export {
   OpenBaoAuthConfigTag,
   ParsedParsecAddrTag,
   ParseParsecAddrErrorTag,
+  PkiEnrollmentFinalizeErrorTag,
+  PkiEnrollmentListItemTag,
+  PkiEnrollmentSubmitErrorTag,
+  PKIInfoItemTag,
   Platform,
   ShowCertificateSelectionDialogErrorTag,
   UpdateDeviceErrorTag,
@@ -190,10 +195,12 @@ export type {
   InviteListItem,
   ListAvailableDeviceError,
   ListInvitationsError,
+  ListPkiLocalPendingError,
   MountpointToOsPathError,
   NewInvitationInfo,
   OpenBaoAuthConfig,
   ParsecAddr,
+  ParsecPkiEnrollmentAddr,
   ParsecWorkspacePathAddr,
   ParsedParsecAddr,
   ParsedParsecAddrInvitationDevice,
@@ -204,6 +211,19 @@ export type {
   ParsedParsecAddrServer,
   ParsedParsecAddrWorkspacePath,
   ParseParsecAddrError,
+  PkiEnrollmentAcceptError,
+  PkiEnrollmentFinalizeError,
+  PkiEnrollmentListError,
+  PkiEnrollmentListItem,
+  PkiEnrollmentListItemInvalid,
+  PkiEnrollmentListItemValid,
+  PkiEnrollmentRejectError,
+  PkiEnrollmentSubmitError,
+  PkiEnrollmentSubmitPayload,
+  PkiGetAddrError,
+  PKIInfoItemAccepted,
+  PKILocalPendingEnrollment,
+  RemoveDeviceError,
   Result,
   SASCode,
   SecretKey,
@@ -271,6 +291,8 @@ import type {
   WorkspaceHistoryEntryStatFolder as ParsecWorkspaceHistoryEntryStatFolder,
   WorkspaceInfo as ParsecWorkspaceInfo,
   Path,
+  PKIInfoItem,
+  PKILocalPendingEnrollment,
   UserID,
   UserProfile,
   VlobID,
@@ -429,6 +451,11 @@ interface AuthMethodInfo extends ParsecAuthMethodInfo {
   current: boolean;
 }
 
+interface PkiLocalRequest {
+  info: PKIInfoItem;
+  enrollment: PKILocalPendingEnrollment;
+}
+
 export {
   AccountHandle,
   AccountInvitation,
@@ -455,6 +482,7 @@ export {
   OrganizationInfoErrorTag,
   OwnDeviceInfo,
   ParsecOrganizationAddr,
+  PkiLocalRequest,
   RegistrationDevice,
   StartedWorkspaceInfo,
   SystemPath,
diff --git a/client/src/router/types.ts b/client/src/router/types.ts
index 3e02ec11347..5c586d1f1d5 100644
--- a/client/src/router/types.ts
+++ b/client/src/router/types.ts
@@ -294,6 +294,7 @@ export interface Query {
   documentPath?: FsPath;
   deviceId?: DeviceID;
   claimLink?: string;
+  pkiLink?: string;
   bootstrapLink?: string;
   fileLink?: ParsecWorkspacePathAddr;
   openInvite?: true;
diff --git a/client/src/services/linkHandler.ts b/client/src/services/linkHandler.ts
index 31c92f5080e..37b31df3454 100644
--- a/client/src/services/linkHandler.ts
+++ b/client/src/services/linkHandler.ts
@@ -1,8 +1,14 @@
 // Parsec Cloud (https://parsec.cloud) Copyright (c) BUSL-1.1 2016-present Scille SAS
 
 import { availableDeviceMatchesServer } from '@/common/device';
-import { bootstrapLinkValidator, claimLinkValidator, fileLinkValidator } from '@/common/validators';
-import { AvailableDevice, getOrganizationHandle, listAvailableDevices, parseFileLink } from '@/parsec';
+import {
+  AvailableDevice,
+  getOrganizationHandle,
+  listAvailableDevices,
+  ParsedParsecAddrTag,
+  parseFileLink,
+  parseParsecAddr,
+} from '@/parsec';
 import {
   backupCurrentOrganization,
   currentRouteIs,
@@ -14,7 +20,7 @@ import {
 } from '@/router';
 import { Information, InformationLevel, InformationManager, PresentationMode } from '@/services/informationManager';
 import { modalController, popoverController } from '@ionic/vue';
-import { Base64, Validity } from 'megashark-lib';
+import { Base64 } from 'megashark-lib';
 
 async function handleJoinLink(link: string): Promise<void> {
   if (!currentRouteIs(Routes.Home)) {
@@ -30,6 +36,13 @@ async function handleBootstrapLink(link: string): Promise<void> {
   await navigateTo(Routes.Home, { query: { bootstrapLink: link } });
 }
 
+async function handlePkiLink(link: string): Promise<void> {
+  if (!currentRouteIs(Routes.Home)) {
+    await switchOrganization(null, true);
+  }
+  await navigateTo(Routes.Home, { query: { pkiLink: link } });
+}
+
 async function handleFileLink(link: string, informationManager: InformationManager): Promise<void> {
   const result = await parseFileLink(link);
   if (!result.ok) {
@@ -111,13 +124,9 @@ export async function handleParsecLink(link: string, informationManager: Informa
   if (await popoverController.getTop()) {
     await popoverController.dismiss();
   }
-  if ((await claimLinkValidator(link)).validity === Validity.Valid) {
-    await handleJoinLink(link);
-  } else if ((await fileLinkValidator(link)).validity === Validity.Valid) {
-    await handleFileLink(link, informationManager);
-  } else if ((await bootstrapLinkValidator(link)).validity === Validity.Valid) {
-    await handleBootstrapLink(link);
-  } else {
+  const result = await parseParsecAddr(link);
+
+  if (!result.ok) {
     await informationManager.present(
       new Information({
         message: 'link.invalid',
@@ -125,5 +134,15 @@ export async function handleParsecLink(link: string, informationManager: Informa
       }),
       PresentationMode.Modal,
     );
+    return;
+  }
+  if (result.value.tag === ParsedParsecAddrTag.InvitationUser || result.value.tag === ParsedParsecAddrTag.InvitationDevice) {
+    await handleJoinLink(link);
+  } else if (result.value.tag === ParsedParsecAddrTag.WorkspacePath) {
+    await handleFileLink(link, informationManager);
+  } else if (result.value.tag === ParsedParsecAddrTag.OrganizationBootstrap) {
+    await handleBootstrapLink(link);
+  } else if (result.value.tag === ParsedParsecAddrTag.PkiEnrollment) {
+    await handlePkiLink(link);
   }
 }
diff --git a/client/src/views/home/HomePage.vue b/client/src/views/home/HomePage.vue
index f09589d91c5..0af6d5cf422 100644
--- a/client/src/views/home/HomePage.vue
+++ b/client/src/views/home/HomePage.vue
@@ -99,23 +99,23 @@ import {
   ClientStartErrorTag,
   DeviceAccessStrategy,
   DeviceAccessStrategyTag,
-  JoinRequestStatus,
   ListAvailableDeviceErrorTag,
-  LocalJoinRequest,
+  PKIInfoItemTag,
   ParsecAccount,
+  PkiLocalRequest,
   archiveDevice,
   cancelLocalJoinRequest,
   confirmLocalJoinRequest,
   getDeviceHandle,
   getOrganizationCreationDate,
   isDeviceLoggedIn,
+  isSmartcardAvailable,
   isWeb,
   listAvailableDevices,
   listAvailableDevicesWithError,
   listLocalJoinRequests,
   parseParsecAddr,
   login as parsecLogin,
-  requestJoinOrganization,
 } from '@/parsec';
 import { RouteBackup, Routes, currentRouteIs, getCurrentRouteQuery, navigateTo, switchOrganization, watchRoute } from '@/router';
 import { EventData, EventDistributor, Events } from '@/services/eventDistributor';
@@ -136,6 +136,7 @@ import LoginPage from '@/views/home/LoginPage.vue';
 import OrganizationListPage from '@/views/home/OrganizationListPage.vue';
 import UserJoinOrganizationModal from '@/views/home/UserJoinOrganizationModal.vue';
 import CreateOrganizationModal from '@/views/organizations/creation/CreateOrganizationModal.vue';
+import JoinWithSmartcardModal from '@/views/users/JoinWithSmartcardModal.vue';
 import { IonContent, IonPage, modalController, popoverController } from '@ionic/vue';
 import { DateTime } from 'luxon';
 import {
@@ -174,7 +175,7 @@ const loginInProgress = ref(false);
 const queryInProgress = ref(false);
 const querying = ref(true);
 const deviceList: Ref<AvailableDevice[]> = ref([]);
-const pkiRequestList: Ref<LocalJoinRequest[]> = ref([]);
+const pkiRequestList = ref<Array<PkiLocalRequest>>([]);
 const invitationList = ref<Array<AccountInvitation>>([]);
 const activeTab = ref(AccountSettingsTabs.Settings);
 let eventCallbackId!: string;
@@ -351,6 +352,8 @@ async function handleQuery(): Promise<void> {
     await openJoinByLinkModal(query.claimLink);
   } else if (query.bootstrapLink) {
     await openCreateOrganizationModal(query.bootstrapLink);
+  } else if (query.pkiLink) {
+    await handleJoinByPki(query.pkiLink);
   } else if (query.deviceId) {
     const availableDevices = await listAvailableDevices();
     const device = availableDevices.find((d) => d.deviceId === query.deviceId);
@@ -426,51 +429,81 @@ async function onJoinOrganizationClicked(): Promise<void> {
 }
 
 async function handleJoinByPki(link: string): Promise<void> {
-  const result = await requestJoinOrganization(link);
+  const pkiAvailable = await isSmartcardAvailable();
 
-  if (result.ok) {
-    await refreshPkiRequestsList();
+  if (!pkiAvailable) {
     informationManager.present(
       new Information({
-        message: 'HomePage.organizationRequest.requestSent.success',
-        level: InformationLevel.Success,
-      }),
-      PresentationMode.Toast,
-    );
-  } else {
-    informationManager.present(
-      new Information({
-        message: 'HomePage.organizationRequest.requestSent.failure',
+        message: 'HomePage.organizationRequest.notAvailable',
         level: InformationLevel.Error,
       }),
       PresentationMode.Toast,
     );
+    return;
   }
+
+  const modal = await modalController.create({
+    component: JoinWithSmartcardModal,
+    showBackdrop: true,
+    backdropDismiss: false,
+    componentProps: {
+      addr: link,
+    },
+    cssClass: 'join-pki-modal',
+  });
+  await modal.present();
+  const { role } = await modal.onDidDismiss();
+  await modal.dismiss();
+
+  if (role !== MsModalResult.Confirm) {
+    return;
+  }
+
+  informationManager.present(
+    new Information({
+      message: 'HomePage.organizationRequest.requestSent.success',
+      level: InformationLevel.Success,
+    }),
+    PresentationMode.Toast,
+  );
+
+  await refreshPkiRequestsList();
 }
 
-async function onPkiRequestClicked(pkiRequest: LocalJoinRequest): Promise<void> {
-  if (pkiRequest.status === JoinRequestStatus.Pending) {
+async function onPkiRequestClicked(pkiRequest: PkiLocalRequest): Promise<void> {
+  if (pkiRequest.info.tag === PKIInfoItemTag.Submitted) {
     const answer = await askQuestion('HomePage.organizationRequest.pending.title', 'HomePage.organizationRequest.pending.message', {
       yesText: 'HomePage.organizationRequest.pending.yes',
       noText: 'HomePage.organizationRequest.pending.no',
     });
     if (answer === Answer.Yes) {
-      await cancelLocalJoinRequest(pkiRequest);
-      informationManager.present(
-        new Information({
-          message: 'HomePage.organizationRequest.requestCancelled',
-          level: InformationLevel.Success,
-        }),
-        PresentationMode.Toast,
-      );
+      const result = await cancelLocalJoinRequest(toRaw(pkiRequest));
+      if (result.ok) {
+        informationManager.present(
+          new Information({
+            message: 'HomePage.organizationRequest.requestCancelled',
+            level: InformationLevel.Success,
+          }),
+          PresentationMode.Toast,
+        );
+      } else {
+        window.electronAPI.log('error', `Failed to cancel pki request: ${result.error.tag} (${result.error.error})`);
+        informationManager.present(
+          new Information({
+            message: 'HomePage.organizationRequest.requestCancelError',
+            level: InformationLevel.Success,
+          }),
+          PresentationMode.Toast,
+        );
+      }
     }
-  } else if (pkiRequest.status === JoinRequestStatus.Rejected) {
+  } else if (pkiRequest.info.tag === PKIInfoItemTag.Rejected) {
     const answer = await askQuestion('HomePage.organizationRequest.rejected.title', 'HomePage.organizationRequest.rejected.message', {
       yesText: 'HomePage.organizationRequest.rejected.yes',
       noText: 'HomePage.organizationRequest.rejected.no',
     });
     if (answer === Answer.Yes) {
-      await cancelLocalJoinRequest(pkiRequest);
+      await cancelLocalJoinRequest(toRaw(pkiRequest));
       informationManager.present(
         new Information({
           message: 'HomePage.organizationRequest.requestDeleted',
@@ -479,8 +512,10 @@ async function onPkiRequestClicked(pkiRequest: LocalJoinRequest): Promise<void>
         PresentationMode.Toast,
       );
     }
-  } else if (pkiRequest.status === JoinRequestStatus.Accepted) {
-    const result = await confirmLocalJoinRequest(pkiRequest);
+  } else if (pkiRequest.info.tag === PKIInfoItemTag.Cancelled) {
+    await cancelLocalJoinRequest(toRaw(pkiRequest));
+  } else if (pkiRequest.info.tag === PKIInfoItemTag.Accepted) {
+    const result = await confirmLocalJoinRequest(toRaw(pkiRequest));
     if (result.ok) {
       informationManager.present(
         new Information({
@@ -490,8 +525,7 @@ async function onPkiRequestClicked(pkiRequest: LocalJoinRequest): Promise<void>
         PresentationMode.Toast,
       );
       await refreshDeviceList();
-      // TODO: automatically login with the new device
-      // await login(result.value, AccessStrategy.useSmartcard(result.value));
+      await login(result.value, AccessStrategy.useSmartcard(result.value));
     } else {
       informationManager.present(
         new Information({
diff --git a/client/src/views/home/OrganizationListPage.vue b/client/src/views/home/OrganizationListPage.vue
index e0f6ef38353..bc29f811048 100644
--- a/client/src/views/home/OrganizationListPage.vue
+++ b/client/src/views/home/OrganizationListPage.vue
@@ -270,7 +270,7 @@
           </ion-text>
           <organization-pki-request
             v-for="pkiRequest in pkiRequestList"
-            :key="pkiRequest.certificate"
+            :key="pkiRequest.enrollment.enrollmentId"
             :request="pkiRequest"
             @join-organization="$emit('pkiRequestClick', $event)"
             @delete-request="$emit('pkiRequestClick', $event)"
@@ -285,7 +285,7 @@
 
           <ion-text
             class="organization-list__title title-h5"
-            v-if="pkiRequestList.length > 0"
+            v-if="filteredDevices.length > 0"
           >
             {{ $msTranslate('HomePage.organizationList.subtitle') }}
           </ion-text>
@@ -320,7 +320,7 @@ import MailUnreadGradient from '@/assets/images/mail-unread-gradient.svg?raw';
 import { bootstrapLinkValidator, claimAndBootstrapLinkValidator } from '@/common/validators';
 import OrganizationCard from '@/components/organizations/OrganizationCard.vue';
 import OrganizationPkiRequest from '@/components/organizations/OrganizationPkiRequest.vue';
-import { AccountInvitation, AvailableDevice, getLoggedInDevices, LocalJoinRequest, LoggedInDeviceInfo } from '@/parsec';
+import { AccountInvitation, AvailableDevice, getLoggedInDevices, LoggedInDeviceInfo, PkiLocalRequest } from '@/parsec';
 import { Routes } from '@/router';
 import { Env } from '@/services/environment';
 import { HotkeyGroup, HotkeyManager, HotkeyManagerKey, Modifiers, Platforms } from '@/services/hotkeyManager';
@@ -351,13 +351,13 @@ const emits = defineEmits<{
   (e: 'recoverClick'): void;
   (e: 'createOrJoinOrganizationClick', event: Event): void;
   (e: 'invitationClick', invitation: AccountInvitation): void;
-  (e: 'pkiRequestClick', pkiRequest: LocalJoinRequest): void;
+  (e: 'pkiRequestClick', pkiRequest: PkiLocalRequest): void;
 }>();
 
 const props = defineProps<{
   deviceList: AvailableDevice[];
   invitationList: AccountInvitation[];
-  pkiRequestList: LocalJoinRequest[];
+  pkiRequestList: PkiLocalRequest[];
   querying: boolean;
 }>();
 
diff --git a/client/src/views/invitations/InvitationsPage.vue b/client/src/views/invitations/InvitationsPage.vue
index 560fd410295..34bcbe3d4b2 100644
--- a/client/src/views/invitations/InvitationsPage.vue
+++ b/client/src/views/invitations/InvitationsPage.vue
@@ -3,7 +3,7 @@
 <template>
   <ion-page class="invitations-page">
     <div
-      v-if="isSmallDisplay && false"
+      v-if="isSmallDisplay"
       class="switch-view"
     >
       <ion-button
@@ -47,7 +47,7 @@
           class="toggle-view"
           role="tablist"
           aria-label="Invitation view toggle"
-          v-if="isLargeDisplay && false"
+          v-if="isLargeDisplay"
         >
           <ion-button
             class="toggle-view-button email-button"
@@ -67,9 +67,13 @@
           </ion-button>
           <ion-button
             class="toggle-view-button pki-button"
-            :class="{ active: view === InvitationView.PkiRequest }"
+            :class="{
+              active: view === InvitationView.PkiRequest,
+              disabled: !pkiAvailable,
+            }"
             @click="switchView(InvitationView.PkiRequest)"
-            :disabled="view === InvitationView.PkiRequest"
+            ref="switchToPkiButton"
+            :disabled="!pkiAvailable || view === InvitationView.PkiRequest"
           >
             <ion-icon
               :icon="idCard"
@@ -79,13 +83,25 @@
               <span v-if="windowWidth > WindowSizeBreakpoints.MD">{{ $msTranslate('InvitationsPage.pkiRequests.tab') }}</span>
               <span v-else>{{ $msTranslate('InvitationsPage.pkiRequests.tabShort') }}</span>
             </ion-text>
-            <span class="toggle-view-button__count">{{ pkiRequests.length }}</span>
+            <span
+              class="toggle-view-button__count"
+              v-show="pkiAvailable"
+            >
+              {{ pkiRequests.length }}
+            </span>
           </ion-button>
+          <ion-text
+            class="toggle-view-unavailable button-medium"
+            v-show="!pkiAvailable"
+            ref="pkiUnavailable"
+          >
+            {{ $msTranslate('InvitationsPage.pkiRequests.notAvailable') }}
+          </ion-text>
         </div>
 
         <ion-button
-          v-if="view === InvitationView.PkiRequest && rootCertificate"
-          @click="selectRootCertificate"
+          v-if="view === InvitationView.PkiRequest && adminCertificate"
+          @click="selectAdminCertificate"
           id="update-root-certificate-button"
           class="button-medium button-default certificate-button"
           fill="clear"
@@ -158,17 +174,11 @@
       </div>
       <div
         class="invitations-container scroll"
-        v-if="view === InvitationView.PkiRequest"
+        v-if="pkiAvailable && view === InvitationView.PkiRequest"
       >
-        <input
-          type="file"
-          ref="input"
-          hidden
-          @change="onInputChange"
-        />
         <div
           class="root-certificate"
-          v-if="!rootCertificate"
+          v-if="!adminCertificate"
         >
           <div class="root-certificate-content">
             <ms-image
@@ -191,7 +201,7 @@
             </ms-report-text>
             <ion-button
               class="button-large button-default"
-              @click="selectRootCertificate"
+              @click="selectAdminCertificate"
             >
               <ms-image
                 :image="DocumentImport"
@@ -202,7 +212,7 @@
           </div>
         </div>
         <div
-          v-show="invitations.length === 0"
+          v-show="pkiRequests.length === 0"
           class="no-active body-lg"
         >
           <div class="no-active-content">
@@ -212,7 +222,7 @@
             </ion-text>
           </div>
         </div>
-        <div v-show="(invitations.length > 0 && isLargeDisplay) || (rootCertificate && pkiRequests.length > 0)">
+        <div v-show="pkiRequests.length > 0">
           <pki-request-list
             :requests="pkiRequests"
             @accept-click="onAcceptPkiRequestClicked"
@@ -236,13 +246,16 @@ import {
   ClientNewUserInvitationErrorTag,
   getPkiJoinOrganizationLink,
   InvitationEmailSentStatus,
-  JoinRequestValidity,
+  isSmartcardAvailable,
   listOrganizationJoinRequests,
   listUserInvitations,
-  OrganizationJoinRequest,
   inviteUser as parsecInviteUser,
+  PkiEnrollmentListItem,
+  PkiEnrollmentListItemTag,
   rejectOrganizationJoinRequest,
+  selectCertificate,
   UserInvitation,
+  X509CertificateReference,
 } from '@/parsec';
 import { currentRouteIs, getCurrentRouteQuery, navigateTo, Routes, watchRoute } from '@/router';
 import { EventData, EventDistributor, EventDistributorKey, Events } from '@/services/eventDistributor';
@@ -269,7 +282,7 @@ import {
   useWindowSize,
   WindowSizeBreakpoints,
 } from 'megashark-lib';
-import { inject, onMounted, onUnmounted, ref, useTemplateRef, watch } from 'vue';
+import { inject, onMounted, onUnmounted, ref, toRaw, useTemplateRef, watch } from 'vue';
 
 const { isLargeDisplay, isSmallDisplay, windowWidth } = useWindowSize();
 const view = ref(InvitationView.EmailInvitation);
@@ -277,10 +290,10 @@ const informationManager: InformationManager = inject(InformationManagerKey)!;
 const eventDistributor: EventDistributor = inject(EventDistributorKey)!;
 
 const invitations = ref<Array<UserInvitation>>([]);
-const pkiRequests = ref<Array<OrganizationJoinRequest>>([]);
-const rootCertificate = ref<string | undefined>(undefined);
-const inputRef = useTemplateRef<HTMLInputElement>('input');
-const updateRootCertificateButtonRef = useTemplateRef<InstanceType<typeof IonButton>>('updateRootCertificateButton');
+const pkiRequests = ref<Array<PkiEnrollmentListItem>>([]);
+const adminCertificate = ref<X509CertificateReference | undefined>(undefined);
+const updateAdminCertificateButtonRef = useTemplateRef<InstanceType<typeof IonButton>>('updateRootCertificateButton');
+const pkiAvailable = ref(false);
 
 let eventCbId: string | null = null;
 
@@ -308,6 +321,8 @@ onMounted(async (): Promise<void> => {
       await refreshInvitationList();
     }
   });
+  pkiAvailable.value = await isSmartcardAvailable();
+
   await refreshAll();
   const query = getCurrentRouteQuery();
 
@@ -322,7 +337,7 @@ onMounted(async (): Promise<void> => {
   }
 });
 
-watch(updateRootCertificateButtonRef, (el) => {
+watch(updateAdminCertificateButtonRef, (el) => {
   if (el && el.$el) {
     attachMouseOverTooltip(el.$el, 'InvitationsPage.pkiRequests.rootCertificate.updateRootCertificate');
   }
@@ -599,41 +614,30 @@ async function onCopyJoinLinkClicked(): Promise<void> {
       'InvitationsPage.pkiRequests.linkCopiedToClipboard.success',
       'InvitationsPage.pkiRequests.linkCopiedToClipboard.failed',
     );
+  } else {
+    informationManager.present(
+      new Information({
+        message: 'InvitationsPage.pkiRequests.linkCopiedToClipboard.failed',
+        level: InformationLevel.Error,
+      }),
+      PresentationMode.Toast,
+    );
   }
 }
 
-async function onAcceptPkiRequestClicked(req: OrganizationJoinRequest): Promise<void> {
-  if (req.validity === JoinRequestValidity.Unknown) {
-    const answer = await askQuestion(
-      'InvitationsPage.pkiRequests.validationModal.error.unknown.title',
-      'InvitationsPage.pkiRequests.validationModal.error.unknown.description',
-      {
-        yesText: 'InvitationsPage.pkiRequests.validationModal.button.confirm',
-        noText: 'InvitationsPage.pkiRequests.validationModal.button.cancel',
-      },
-    );
-    if (answer !== Answer.Yes) {
-      return;
-    }
-  } else if (req.validity === JoinRequestValidity.Invalid) {
-    const answer = await askQuestion(
-      'InvitationsPage.pkiRequests.validationModal.error.notValid.title',
-      'InvitationsPage.pkiRequests.validationModal.error.notValid.description',
-      {
-        yesText: 'InvitationsPage.pkiRequests.validationModal.button.confirm',
-        noText: 'InvitationsPage.pkiRequests.validationModal.button.cancel',
-      },
-    );
-    if (answer !== Answer.Yes) {
-      return;
-    }
+async function onAcceptPkiRequestClicked(request: PkiEnrollmentListItem): Promise<void> {
+  if (!adminCertificate.value) {
+    return;
+  }
+  if (request.tag !== PkiEnrollmentListItemTag.Valid) {
+    return;
   }
 
   const modal = await modalController.create({
     component: SelectProfileModal,
     componentProps: {
-      email: req.humanHandle.email,
-      name: req.humanHandle.label,
+      email: request.payload.humanHandle.email,
+      name: request.payload.humanHandle.label,
     },
     cssClass: 'select-profile-modal',
   });
@@ -645,7 +649,7 @@ async function onAcceptPkiRequestClicked(req: OrganizationJoinRequest): Promise<
     return;
   }
 
-  const result = await acceptOrganizationJoinRequest(req, data.profile);
+  const result = await acceptOrganizationJoinRequest(toRaw(request), data.profile, toRaw(adminCertificate.value));
   if (result.ok) {
     informationManager.present(
       new Information({
@@ -665,8 +669,8 @@ async function onAcceptPkiRequestClicked(req: OrganizationJoinRequest): Promise<
   }
 }
 
-async function onRejectPkiRequestClicked(req: OrganizationJoinRequest): Promise<void> {
-  const result = await rejectOrganizationJoinRequest(req);
+async function onRejectPkiRequestClicked(request: PkiEnrollmentListItem): Promise<void> {
+  const result = await rejectOrganizationJoinRequest(request);
   if (result.ok) {
     informationManager.present(
       new Information({
@@ -686,17 +690,13 @@ async function onRejectPkiRequestClicked(req: OrganizationJoinRequest): Promise<
   }
 }
 
-async function selectRootCertificate(): Promise<void> {
-  inputRef.value?.click();
-}
-
-async function onInputChange(): Promise<void> {
-  if (!inputRef.value?.files) {
-    return;
+async function selectAdminCertificate(): Promise<void> {
+  const result = await selectCertificate();
+  if (result.ok && result.value) {
+    adminCertificate.value = result.value;
+  } else {
+    adminCertificate.value = undefined;
   }
-  const file = inputRef.value.files.item(0) as File;
-  rootCertificate.value = await file.text();
-  await refreshPkiRequestList();
 }
 
 async function refreshInvitationList(): Promise<void> {
@@ -709,7 +709,10 @@ async function refreshInvitationList(): Promise<void> {
 }
 
 async function refreshPkiRequestList(): Promise<void> {
-  const result = await listOrganizationJoinRequests(rootCertificate.value);
+  if (!pkiAvailable.value) {
+    return;
+  }
+  const result = await listOrganizationJoinRequests();
   if (result.ok) {
     pkiRequests.value = result.value;
   } else {
@@ -762,8 +765,8 @@ async function refreshAll(): Promise<void> {
     background: var(--parsec-color-light-secondary-medium);
     border: 2px solid var(--parsec-color-light-secondary-medium);
     border-radius: var(--parsec-radius-8);
-    overflow: hidden;
     box-shadow: 0 0 11px 0 rgba(0, 0, 0, 0.05) inset;
+    position: relative;
 
     @include ms.responsive-breakpoint('lg') {
       border: 1px solid var(--parsec-color-light-secondary-medium);
@@ -812,6 +815,7 @@ async function refreshAll(): Promise<void> {
         --color: var(--parsec-color-light-primary-700);
         cursor: default;
         opacity: 1;
+        display: flex;
       }
 
       &:not(.active) {
@@ -826,6 +830,30 @@ async function refreshAll(): Promise<void> {
           --background-hover: var(--parsec-color-light-secondary-medium);
         }
       }
+
+      &.disabled {
+        .toggle-view-button__icon,
+        .toggle-view-button__label {
+          opacity: 0.8;
+        }
+
+        .toggle-view-button__count {
+          background: var(--parsec-color-light-secondary-soft-text);
+          color: var(--parsec-color-light-secondary-white);
+          padding: 3px 0.4rem;
+        }
+      }
+    }
+
+    &-unavailable {
+      top: -0.65rem;
+      right: -2rem;
+      color: var(--parsec-color-light-secondary-white);
+      align-self: center;
+      padding: 0.125rem 0.5rem;
+      margin-right: 0.25rem;
+      background: var(--parsec-color-light-secondary-text);
+      border-radius: var(--parsec-radius-8);
     }
   }
 
diff --git a/client/src/views/invitations/PkiRequestList.vue b/client/src/views/invitations/PkiRequestList.vue
index afaff03b8ab..7c4c597232c 100644
--- a/client/src/views/invitations/PkiRequestList.vue
+++ b/client/src/views/invitations/PkiRequestList.vue
@@ -2,6 +2,32 @@
 
 <template>
   <ion-list class="list pkiRequests-container-list">
+    <div
+      v-for="request in requests.filter((req) => req.tag === PkiEnrollmentListItemTag.Invalid)"
+      :key="request.enrollmentId"
+      class="invalid-request"
+    >
+      <ion-text class="invalid-request-title title-h4">
+        {{ $msTranslate('InvitationsPage.pkiRequests.invalidRequest') }}
+      </ion-text>
+      <div class="invalid-request-text">
+        <ion-text class="invalid-request-text__description subtitles-normal">
+          {{ $msTranslate(getInvalidReason(request)) }}
+        </ion-text>
+        <ion-text class="invalid-request-text__time body">
+          {{ $msTranslate(formatTimeSince(request.submittedOn, '--', 'short')) }}
+        </ion-text>
+      </div>
+      <ion-button
+        @click="$emit('rejectClick', request)"
+        class="invalid-request__button button-medium button-default"
+      >
+        <ion-icon
+          :icon="closeCircle"
+          class="button-icon"
+        />
+      </ion-button>
+    </div>
     <ion-list-header
       class="pkiRequests-list-header"
       lines="full"
@@ -22,9 +48,9 @@
       <ion-text class="pkiRequests-list-header__label cell-title label-space" />
     </ion-list-header>
     <pki-request-item
-      v-for="request in requests"
+      v-for="request in requests.filter((req) => req.tag === PkiEnrollmentListItemTag.Valid)"
       class="request"
-      :key="request.certificate"
+      :key="request.enrollmentId"
       :request="request"
       @accept-click="$emit('acceptClick', request)"
       @reject-click="$emit('rejectClick', request)"
@@ -34,21 +60,110 @@
 
 <script setup lang="ts">
 import PkiRequestItem from '@/components/invitations/PkiRequestItem.vue';
-import { OrganizationJoinRequest } from '@/parsec';
-import { IonList, IonListHeader, IonText } from '@ionic/vue';
-import { useWindowSize } from 'megashark-lib';
+import { InvalidityReasonTag, PkiEnrollmentListItem, PkiEnrollmentListItemInvalid, PkiEnrollmentListItemTag } from '@/parsec';
+import { IonButton, IonIcon, IonList, IonListHeader, IonText } from '@ionic/vue';
+import { closeCircle } from 'ionicons/icons';
+import { formatTimeSince, Translatable, useWindowSize } from 'megashark-lib';
 
 const { isLargeDisplay } = useWindowSize();
 
 defineProps<{
-  requests: Array<OrganizationJoinRequest>;
+  requests: Array<PkiEnrollmentListItem>;
 }>();
 
 defineEmits<{
-  (e: 'acceptClick', invitation: OrganizationJoinRequest): void;
-  (e: 'rejectClick', invitation: OrganizationJoinRequest): void;
+  (e: 'acceptClick', invitation: PkiEnrollmentListItem): void;
+  (e: 'rejectClick', invitation: PkiEnrollmentListItem): void;
   (e: 'copyJoinLinkClick'): void;
 }>();
+
+function getInvalidReason(request: PkiEnrollmentListItemInvalid): Translatable {
+  switch (request.reason.tag) {
+    case InvalidityReasonTag.DateTimeOutOfRange:
+      return 'InvitationsPage.pkiRequests.invalidityReasons.expired';
+    case InvalidityReasonTag.CannotGetCertificateInfo:
+      return 'InvitationsPage.pkiRequests.invalidityReasons.noInfo';
+    case InvalidityReasonTag.InvalidRootCertificate:
+      return 'InvitationsPage.pkiRequests.invalidityReasons.noRootCertificate';
+    case InvalidityReasonTag.Untrusted:
+      return 'InvitationsPage.pkiRequests.invalidityReasons.untrusted';
+    default:
+      return 'InvitationsPage.pkiRequests.invalidityReasons.generic';
+  }
+}
 </script>
 
-<style scoped lang="scss"></style>
+<style scoped lang="scss">
+.invalid-request {
+  background: var(--parsec-color-light-danger-50);
+  border: 1px solid var(--parsec-color-light-danger-100);
+  border-radius: var(--parsec-radius-12);
+  margin: 1rem;
+  padding: 1rem;
+  display: flex;
+  max-width: 60rem;
+  gap: 1rem;
+  align-items: center;
+  position: relative;
+
+  @include ms.responsive-breakpoint('md') {
+    flex-direction: column;
+    align-items: start;
+  }
+
+  @include ms.responsive-breakpoint('sm') {
+    margin: 0.75rem 0;
+  }
+
+  &-text {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+
+    @include ms.responsive-breakpoint('md') {
+      padding-right: 2rem;
+    }
+
+    @include ms.responsive-breakpoint('md') {
+      padding-right: 3rem;
+    }
+
+    &__description {
+      color: var(--parsec-color-light-secondary-text);
+    }
+
+    &__time {
+      color: var(--parsec-color-light-secondary-text);
+      opacity: 0.7;
+    }
+  }
+
+  &-title {
+    color: var(--parsec-color-light-danger-700);
+    font-weight: 600;
+  }
+
+  &__button {
+    margin-left: auto;
+
+    @include ms.responsive-breakpoint('md') {
+      position: absolute;
+      top: 50%;
+      right: 0;
+      transform: translate(-50%, -50%);
+      height: fit-content;
+    }
+
+    &::part(native) {
+      --background-hover: var(--parsec-color-light-danger-100);
+      --background: none;
+      padding: 0.5rem;
+    }
+
+    .button-icon {
+      font-size: 1.25rem;
+      color: var(--parsec-color-light-danger-500);
+    }
+  }
+}
+</style>
diff --git a/client/src/views/users/JoinWithSmartcardModal.vue b/client/src/views/users/JoinWithSmartcardModal.vue
new file mode 100644
index 00000000000..2edd2f27a22
--- /dev/null
+++ b/client/src/views/users/JoinWithSmartcardModal.vue
@@ -0,0 +1,271 @@
+<!-- Parsec Cloud (https://parsec.cloud) Copyright (c) BUSL-1.1 2016-present Scille SAS -->
+
+<template>
+  <ion-page class="join-smartcard-modal">
+    <ms-modal
+      title="JoinOrganization.joinPkiModal.title"
+      :close-button="{ visible: true }"
+      :confirm-button="{
+        disabled: !areInfoValid,
+        label: smartcardAvailable ? 'JoinOrganization.joinPkiModal.buttons.join' : 'JoinOrganization.joinPkiModal.buttons.close',
+        onClick: onJoinClicked,
+        queryingSpinner: sendingRequest,
+      }"
+      :cancel-button="{
+        label: 'JoinOrganization.joinPkiModal.buttons.cancel',
+        disabled: false,
+        onClick: cancel,
+      }"
+    >
+      <div
+        v-if="smartcardAvailable"
+        class="modal-content"
+      >
+        <user-information
+          @field-update="onFieldUpdate"
+          ref="userInformation"
+        />
+        <div
+          class="certificate"
+          :class="{ 'certificate-selected': certificate }"
+        >
+          <ion-text class="certificate-title title-h5">
+            {{ $msTranslate('JoinOrganization.joinPkiModal.certificate.label') }}
+          </ion-text>
+          <div class="certificate-button-container">
+            <div
+              class="certificate-valid"
+              v-if="certificate"
+            >
+              <ion-icon
+                :icon="checkmarkCircle"
+                class="certificate-valid__icon"
+              />
+              <ion-text class="certificate-valid__text button-large">
+                {{ $msTranslate('JoinOrganization.joinPkiModal.certificate.selected') }}
+              </ion-text>
+              <ion-button
+                @click="chooseCertificate"
+                class="certificate-valid__button button-default button-medium"
+                fill="clear"
+              >
+                {{ $msTranslate('JoinOrganization.joinPkiModal.certificate.updateButton') }}
+              </ion-button>
+            </div>
+            <ion-button
+              v-else
+              @click="chooseCertificate"
+              class="certificate-button button-default button-medium"
+            >
+              <ion-icon
+                slot="start"
+                :icon="documentOutline"
+                class="certificate-button__icon"
+              />
+              {{ $msTranslate('JoinOrganization.joinPkiModal.certificate.addButton') }}
+            </ion-button>
+          </div>
+          <ion-text class="certificate-description body">
+            {{ $msTranslate('JoinOrganization.joinPkiModal.certificate.description') }}
+          </ion-text>
+        </div>
+        <ms-report-text
+          v-if="error"
+          :theme="MsReportTheme.Error"
+        >
+          {{ $msTranslate(error) }}
+        </ms-report-text>
+      </div>
+      <div v-else>
+        <ms-report-text :theme="MsReportTheme.Info">
+          {{ $msTranslate('JoinOrganization.joinPkiModal.notAvailable') }}
+        </ms-report-text>
+      </div>
+    </ms-modal>
+  </ion-page>
+</template>
+
+<script setup lang="ts">
+import { UserInformation } from '@/components/users';
+import {
+  isSmartcardAvailable,
+  ParsecPkiEnrollmentAddr,
+  ParsedParsecAddrPkiEnrollment,
+  ParsedParsecAddrTag,
+  parseParsecAddr,
+  PkiEnrollmentSubmitErrorTag,
+  requestJoinOrganization,
+  selectCertificate,
+  X509CertificateReference,
+} from '@/parsec';
+import { IonButton, IonIcon, IonPage, IonText, modalController } from '@ionic/vue';
+import { checkmarkCircle, documentOutline } from 'ionicons/icons';
+import { MsModal, MsModalResult, MsReportText, MsReportTheme } from 'megashark-lib';
+import { onMounted, ref, toRaw, useTemplateRef } from 'vue';
+
+const userInformationRef = useTemplateRef<typeof UserInformation>('userInformation');
+const sendingRequest = ref(false);
+const areInfoValid = ref(false);
+const certificate = ref<X509CertificateReference | undefined>(undefined);
+const joinAddr = ref<ParsedParsecAddrPkiEnrollment | undefined>(undefined);
+const smartcardAvailable = ref(false);
+const error = ref('');
+
+const props = defineProps<{
+  addr: ParsecPkiEnrollmentAddr;
+}>();
+
+onMounted(async () => {
+  const result = await parseParsecAddr(props.addr);
+  if (result.ok && result.value.tag === ParsedParsecAddrTag.PkiEnrollment) {
+    joinAddr.value = result.value;
+  }
+  smartcardAvailable.value = await isSmartcardAvailable();
+});
+
+async function onFieldUpdate(): Promise<void> {
+  areInfoValid.value = userInformationRef.value && (await userInformationRef.value.areFieldsCorrect()) && certificate.value;
+}
+
+async function chooseCertificate(): Promise<void> {
+  const result = await selectCertificate();
+  if (result.ok) {
+    certificate.value = result.value;
+  }
+  await onFieldUpdate();
+}
+
+async function onJoinClicked(): Promise<boolean> {
+  if (!areInfoValid.value || !userInformationRef.value || !certificate.value) {
+    return false;
+  }
+
+  const result = await requestJoinOrganization(
+    toRaw(certificate.value),
+    { label: userInformationRef.value.getFullName(), email: userInformationRef.value.getEmail() },
+    props.addr,
+  );
+
+  if (result.ok) {
+    return await modalController.dismiss(undefined, MsModalResult.Confirm);
+  }
+
+  if (result.error.tag === PkiEnrollmentSubmitErrorTag.EmailAlreadyUsed) {
+    error.value = 'HomePage.organizationRequest.requestSent.emailUsed';
+  } else if (result.error.tag === PkiEnrollmentSubmitErrorTag.AlreadyEnrolled) {
+    error.value = 'HomePage.organizationRequest.requestSent.alreadyEnrolled';
+  } else if (result.error.tag === PkiEnrollmentSubmitErrorTag.AlreadySubmitted) {
+    error.value = 'HomePage.organizationRequest.requestSent.alreadySubmitted';
+  } else if (result.error.tag === PkiEnrollmentSubmitErrorTag.Offline) {
+    error.value = 'HomePage.organizationRequest.requestSent.offline';
+  } else {
+    error.value = 'HomePage.organizationRequest.requestSent.failure';
+  }
+  return false;
+}
+
+async function cancel(): Promise<boolean> {
+  return modalController.dismiss(null, MsModalResult.Cancel);
+}
+</script>
+
+<style scoped lang="scss">
+.modal-content {
+  display: flex;
+  flex-direction: column;
+  gap: 1.5rem;
+}
+
+.certificate {
+  display: flex;
+  flex-direction: column;
+  background: var(--parsec-color-light-secondary-background);
+  border: 1px solid var(--parsec-color-light-secondary-premiere);
+  box-shadow: var(--parsec-shadow-input);
+  padding: 0.75rem;
+  border-radius: var(--parsec-radius-8);
+
+  &-title {
+    margin-bottom: 1rem;
+    color: var(--parsec-color-light-secondary-soft-text);
+  }
+
+  &-button {
+    width: 100%;
+
+    &::part(native) {
+      --background: var(--parsec-color-light-secondary-white);
+      --background-hover: var(--parsec-color-light-secondary-medium);
+      border: 1px dashed var(--parsec-color-light-secondary-light);
+      color: var(--parsec-color-light-secondary-text);
+    }
+
+    &__icon {
+      font-size: 1rem;
+      margin-right: 0.5rem;
+    }
+  }
+
+  &-description {
+    margin-top: 0.5rem;
+    color: var(--parsec-color-light-secondary-hard-grey);
+  }
+
+  &-selected {
+    border-color: var(--parsec-color-light-success-500);
+    background-color: var(--parsec-color-light-success-50);
+    position: relative;
+
+    &__icon {
+      font-size: 1.125rem;
+      position: absolute;
+      top: 0.75rem;
+      right: 0.75rem;
+      color: var(--parsec-color-light-success-700);
+    }
+
+    .certificate-button::part(native) {
+      --background: var(--parsec-color-light-primary-50);
+      --background-hover: var(--parsec-color-light-primary-100);
+      border: 1px solid var(--parsec-color-light-primary-600);
+      color: var(--parsec-color-light-primary-600);
+      align-items: left;
+    }
+
+    .certificate-button-container {
+      border-radius: var(--parsec-radius-12);
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+
+    .certificate-valid {
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+      width: 100%;
+
+      &__icon {
+        font-size: 1.125rem;
+        color: var(--parsec-color-light-success-700);
+      }
+
+      &__text {
+        color: var(--parsec-color-light-success-700);
+      }
+
+      &__button {
+        &::part(native) {
+          --background: none;
+          --background-hover: none;
+          color: var(--parsec-color-light-primary-500);
+        }
+
+        &:hover {
+          text-decoration: underline;
+        }
+      }
+    }
+  }
+}
+</style>
diff --git a/client/tests/e2e/helpers/fixtures.ts b/client/tests/e2e/helpers/fixtures.ts
index ea06febd28b..8dac1b7ba14 100644
--- a/client/tests/e2e/helpers/fixtures.ts
+++ b/client/tests/e2e/helpers/fixtures.ts
@@ -64,6 +64,10 @@ export async function setupNewPage(page: MsPage, opts: SetupOptions = {}): Promi
       }
 
       (window as any).TESTING = true;
+      (window as any).TESTING_PKI = true;
+      if (options.openBaoServer) {
+        (window as any).TESTING_OPEN_BAO_SERVER = options.openBaoServer;
+      }
       if (options.parsecAccountAutoLogin) {
         options.withParsecAccount = true;
         (window as any).TESTING_ACCOUNT_AUTO_LOGIN = true;
diff --git a/client/tests/e2e/specs/home_pki_requests.spec.ts b/client/tests/e2e/specs/home_pki_requests.spec.ts
index d1682e5e88d..f25a9015c0e 100644
--- a/client/tests/e2e/specs/home_pki_requests.spec.ts
+++ b/client/tests/e2e/specs/home_pki_requests.spec.ts
@@ -1,6 +1,6 @@
 // Parsec Cloud (https://parsec.cloud) Copyright (c) BUSL-1.1 2016-present Scille SAS
 
-import { answerQuestion, expect, fillInputModal, getOrganizationAddr, msTest } from '@tests/e2e/helpers';
+import { answerQuestion, expect, fillInputModal, fillIonInput, getOrganizationAddr, msTest } from '@tests/e2e/helpers';
 import { randomInt } from 'crypto';
 
 function getPkiJoinLink(orgName: string): string {
@@ -12,55 +12,72 @@ function getPkiJoinLink(orgName: string): string {
   }
 }
 
-msTest('Create new pki request', async ({ home }) => {
+msTest('List pki requests', async ({ home }) => {
   const requests = home.locator('.organization-list').locator('.organization-request');
-  await expect(requests).toHaveCount(0);
-  await expect(home.locator('.organization-list__title').nth(0)).toBeHidden();
+  await expect(requests).toHaveCount(4);
+  await expect(home.locator('.organization-list__title').nth(0)).toHaveText('Pending requests');
+  await expect(home.locator('.organization-list__title').nth(1)).toHaveText('Your organizations');
 
+  await expect(requests.locator('.organization-request-organization')).toHaveText(['BlackMesa', 'BlackMesa', 'BlackMesa', 'BlackMesa']);
+  // cspell: disable-next-line
+  await expect(requests.locator('.organization-request-username')).toHaveText([
+    'Gordon Freeman',
+    'Gordon Freeman',
+    'Gordon Freeman',
+    'Gordon Freeman',
+  ]);
+  await expect(requests.locator('.organization-request-status')).toHaveText(['', 'Cancelled', 'Rejected', 'Pending']);
+  await expect(requests.locator('.organization-request-button').nth(0)).toBeVisible();
+  await expect(requests.locator('.organization-request-button').nth(0)).toHaveText('Join');
+  await expect(requests.locator('.organization-request-status').nth(0)).toHaveTheClass('status-accepted');
+  await expect(requests.locator('.organization-request-status').nth(1)).toHaveTheClass('status-cancelled');
+  await expect(requests.locator('.organization-request-status').nth(2)).toHaveTheClass('status-rejected');
+  await expect(requests.locator('.organization-request-status').nth(3)).toHaveTheClass('status-pending');
+});
+
+msTest('Create new pki request', async ({ home }) => {
   await home.locator('#create-organization-button').click();
 
   await expect(home.locator('.homepage-popover')).toBeVisible();
   await home.locator('.homepage-popover').getByRole('listitem').nth(1).click();
-
+  const modal = home.locator('.join-pki-modal');
+  await expect(modal).toBeHidden();
   const uniqueOrgName = `${home.orgInfo.name}-${randomInt(2 ** 47)}`;
   await fillInputModal(home, getPkiJoinLink(uniqueOrgName));
-  console.log(getPkiJoinLink(uniqueOrgName));
-  await expect(requests).toHaveCount(1);
+  await expect(modal).toBeVisible();
+  await expect(modal.locator('.ms-modal-header__title')).toHaveText('Join organization with Smartcard');
+  const confirmButton = modal.locator('#next-button');
+  await expect(confirmButton).toBeTrulyDisabled();
+  await fillIonInput(modal.locator('ion-input').nth(0), 'Gordon Freeman');
+  await fillIonInput(modal.locator('ion-input').nth(1), 'gordon.freeman@blackmesa.nm');
+  await expect(confirmButton).toBeTrulyDisabled();
+  await expect(modal.locator('.certificate-valid')).toBeHidden();
+  await modal.locator('.certificate-button').click();
+  await expect(modal.locator('.certificate-valid')).toBeVisible();
+  await expect(modal.locator('.certificate-valid__text')).toHaveText('Certificate selected');
+  await expect(confirmButton).toBeTrulyEnabled();
+  await confirmButton.click();
   await expect(home).toShowToast('Your request to join the organization has been sent.', 'Success');
-  await expect(requests.nth(0).locator('.organization-request-organization')).toHaveText('Black Mesa');
-  // cspell: disable-next-line
-  await expect(requests.nth(0).locator('.organization-request-username')).toHaveText('Isaac Kleiner');
-  await expect(requests.nth(0).locator('.organization-request-status')).toHaveText('Pending');
-  await expect(requests.nth(0).locator('.organization-request-status')).toHaveTheClass('status-pending');
-  await expect(home.locator('.organization-list__title').nth(0)).toHaveText('Pending requests');
-  await expect(home.locator('.organization-list__title').nth(1)).toHaveText('Your organizations');
 });
 
-for (const answer of [true, false]) {
-  msTest(`Cancel pending pki request answer ${['no', 'yes'][Number(answer)]}`, async ({ home }) => {
-    const requests = home.locator('.organization-list').locator('.organization-request');
-    await expect(requests).toHaveCount(0);
-
-    await home.locator('#create-organization-button').click();
-
-    await expect(home.locator('.homepage-popover')).toBeVisible();
-    await home.locator('.homepage-popover').getByRole('listitem').nth(1).click();
+msTest('Cancel pki request answer', async ({ home }) => {
+  const requests = home.locator('.organization-list').locator('.organization-request');
+  await expect(requests).toHaveCount(4);
 
-    const uniqueOrgName = `${home.orgInfo.name}-${randomInt(2 ** 47)}`;
-    await fillInputModal(home, getPkiJoinLink(uniqueOrgName));
-    await expect(requests).toHaveCount(1);
-    await expect(home).toShowToast('Your request to join the organization has been sent.', 'Success');
-    await requests.nth(0).locator('.organization-request-icon').click();
-    await answerQuestion(home, answer, {
-      expectedNegativeText: 'No, wait for validation',
-      expectedPositiveText: 'Cancel request',
-      expectedQuestionText: 'Your request to join the organization is still pending. Are you sure you want to cancel it?',
-      expectedTitleText: 'Organization request pending',
-    });
-    if (answer === false) {
-      await expect(requests).toHaveCount(1);
-    } else {
-      await expect(requests).toHaveCount(0);
-    }
+  await requests.nth(2).locator('.organization-request-icon').click();
+  await answerQuestion(home, true, {
+    expectedNegativeText: 'Keep request',
+    expectedPositiveText: 'Delete request',
+    expectedQuestionText: 'Your request to join the organization has been rejected by an administrator. Do you want to delete it?',
+    expectedTitleText: 'Organization request rejected',
   });
-}
+  await expect(home).toShowToast('Your request to join the organization has been deleted.', 'Success');
+  await requests.nth(3).locator('.organization-request-icon').click();
+  await answerQuestion(home, true, {
+    expectedNegativeText: 'No, wait for validation',
+    expectedPositiveText: 'Cancel request',
+    expectedQuestionText: 'Your request to join the organization is still pending. Are you sure you want to cancel it?',
+    expectedTitleText: 'Organization request pending',
+  });
+  await expect(home).toShowToast('Your request to join the organization has been cancelled.', 'Success');
+});
diff --git a/client/tests/e2e/specs/invitations_pki_page.spec.ts b/client/tests/e2e/specs/invitations_pki_page.spec.ts
index 8a3d3d3c8ad..38291986178 100644
--- a/client/tests/e2e/specs/invitations_pki_page.spec.ts
+++ b/client/tests/e2e/specs/invitations_pki_page.spec.ts
@@ -1,27 +1,12 @@
 // Parsec Cloud (https://parsec.cloud) Copyright (c) BUSL-1.1 2016-present Scille SAS
 
-import { TestInfo } from '@playwright/test';
-import { answerQuestion, expect, getClipboardText, MsPage, msTest, setWriteClipboardPermission } from '@tests/e2e/helpers';
-import path from 'path';
-
-async function setRootCertificate(page: MsPage, certificate = 'data/public_key.pem'): Promise<void> {
-  const fileChooserPromise = page.waitForEvent('filechooser');
-
-  if (await page.locator('.root-certificate').isVisible()) {
-    await page.locator('.root-certificate').locator('ion-button').click();
-  } else {
-    await page.locator('.toggle-view-container').locator('#update-root-certificate-button').click();
-  }
-  const fileChooser = await fileChooserPromise;
-  expect(fileChooser.isMultiple()).toBe(false);
-  await fileChooser.setFiles([certificate]);
-}
+import { expect, getClipboardText, msTest, setWriteClipboardPermission } from '@tests/e2e/helpers';
 
-msTest.skip('PKI requests default state', async ({ invitationsPage }, testInfo: TestInfo) => {
+msTest('PKI requests default state', async ({ invitationsPage }) => {
   const viewToggle = invitationsPage.locator('.toggle-view-container');
 
   await expect(viewToggle.locator('.email-button')).toHaveText('Email invitation1');
-  await expect(viewToggle.locator('.pki-button')).toHaveText('PKI requests3');
+  await expect(viewToggle.locator('.pki-button')).toHaveText('PKI requests6');
   await expect(viewToggle.locator('.email-button')).toBeTrulyDisabled();
   await expect(viewToggle.locator('.pki-button')).toBeTrulyEnabled();
   await viewToggle.locator('.pki-button').click();
@@ -31,7 +16,14 @@ msTest.skip('PKI requests default state', async ({ invitationsPage }, testInfo:
   const container = invitationsPage.locator('.invitations-container');
   const rootCertPopup = container.locator('.root-certificate');
   await expect(rootCertPopup).toBeVisible();
-  await setRootCertificate(invitationsPage, path.join(testInfo.config.rootDir, 'data/public_key.pem'));
+  await expect(rootCertPopup.locator('.root-certificate-text__title')).toHaveText('Missing your certificate');
+  await expect(rootCertPopup.locator('.root-certificate-text__description')).toHaveText(
+    `A certificate is required to validate requests received by PKI.
+For security reasons, the certificate must be provided each time the organization is reopened.`,
+  );
+
+  await expect(rootCertPopup.locator('ion-button')).toHaveText('Set your certificate');
+  await rootCertPopup.locator('ion-button').click();
   await expect(rootCertPopup).toBeHidden();
 
   await expect(viewToggle.locator('#invite-user-button')).toBeHidden();
@@ -39,6 +31,16 @@ msTest.skip('PKI requests default state', async ({ invitationsPage }, testInfo:
   await expect(viewToggle.locator('#copy-link-pki-request-button')).toBeVisible();
   await expect(viewToggle.locator('#copy-link-pki-request-button')).toHaveText('Copy link (PKI)');
 
+  const invalidRequests = container.locator('.pkiRequests-container-list').locator('.invalid-request');
+  await expect(invalidRequests).toHaveCount(5);
+  await expect(invalidRequests.locator('.invalid-request-text__description')).toHaveText([
+    'This certificate cannot be trusted.',
+    'This certificate is invalid.',
+    'Could not find a root certificate matching the provided certificate.',
+    'The provided certificate is expired.',
+    'Could not get any information in the certificate.',
+  ]);
+
   await expect(container.locator('.pkiRequests-container-list').locator('.pkiRequests-list-header__label')).toHaveText([
     'Name',
     'Email',
@@ -47,11 +49,11 @@ msTest.skip('PKI requests default state', async ({ invitationsPage }, testInfo:
     '',
   ]);
   const reqs = container.locator('.pkiRequests-container-list').locator('.pkiRequest-list-item');
-  await expect(reqs).toHaveCount(3);
+  await expect(reqs).toHaveCount(1);
   await expect(reqs.nth(0).locator('.person-name')).toHaveText('Gordon Freeman');
   await expect(reqs.nth(0).locator('.pkiRequest-email')).toHaveText('gordon.freeman@blackmesa.nm');
   await expect(reqs.nth(0).locator('.pkiRequest-createdOn__label')).toHaveText(/^now|< 1 minute$/);
-  await expect(reqs.nth(0).locator('.pkiRequest-certificate__label')).toHaveText('Invalid');
+  await expect(reqs.nth(0).locator('.pkiRequest-certificate__label')).toHaveText('Valid');
   const actions = reqs.nth(0).locator('.pkiRequest-actions').locator('ion-button');
   await expect(actions.nth(0)).toHaveText('Accept');
 
@@ -65,91 +67,64 @@ msTest.skip('PKI requests default state', async ({ invitationsPage }, testInfo:
   // Not adding anything else right now because it's all mocked.
 });
 
-for (const hasPerms in [true, false]) {
-  msTest.skip(
-    `PKI requests copy link ${['without', 'with'][Number(hasPerms)]} permissions`,
-    async ({ invitationsPage }, testInfo: TestInfo) => {
-      const viewToggle = invitationsPage.locator('.toggle-view-container');
-      await viewToggle.locator('.pki-button').click();
-      const container = invitationsPage.locator('.invitations-container');
-      const rootCertPopup = container.locator('.root-certificate');
-      await expect(rootCertPopup).toBeVisible();
-      await setRootCertificate(invitationsPage, path.join(testInfo.config.rootDir, 'data/public_key.pem'));
-      await expect(rootCertPopup).toBeHidden();
-
-      if (hasPerms) {
-        await setWriteClipboardPermission(invitationsPage.context(), true);
-      }
-      await viewToggle.locator('#copy-link-pki-request-button').click();
-      if (hasPerms) {
-        await expect(invitationsPage).toShowToast('PKI link has been copied to clipboard.', 'Info');
-        expect(await getClipboardText(invitationsPage)).toMatch(/^parsec3:\/\/.+$/);
-      } else {
-        await expect(invitationsPage).toShowToast(
-          'Failed to copy the link. Your browser or device does not seem to support copy/paste.',
-          'Error',
-        );
-      }
-    },
-  );
-}
+msTest('PKI requests accept request', async ({ invitationsPage }) => {
+  const viewToggle = invitationsPage.locator('.toggle-view-container');
+
+  await expect(viewToggle.locator('.email-button')).toHaveText('Email invitation1');
+  await expect(viewToggle.locator('.pki-button')).toHaveText('PKI requests6');
+  await viewToggle.locator('.pki-button').click();
+
+  const container = invitationsPage.locator('.invitations-container');
+  const rootCertPopup = container.locator('.root-certificate');
+  await expect(rootCertPopup).toBeVisible();
+  await rootCertPopup.locator('ion-button').click();
+  await expect(rootCertPopup).toBeHidden();
+
+  const reqs = container.locator('.pkiRequests-container-list').locator('.pkiRequest-list-item');
+  await expect(reqs).toHaveCount(1);
+  const actions = reqs.nth(0).locator('.pkiRequest-actions').locator('ion-button');
+  await expect(actions.nth(0)).toHaveText('Accept');
+  const modal = invitationsPage.locator('.select-profile-modal');
+  await expect(modal).toBeHidden();
+  await actions.nth(0).click();
+  await expect(modal).toBeVisible();
+});
 
-for (const answer of [true, false]) {
-  msTest.skip(`PKI requests accept invalid cert answer ${answer}`, async ({ invitationsPage }, testInfo: TestInfo) => {
+for (const hasPerms in [true, false]) {
+  msTest(`PKI requests copy link ${['without', 'with'][Number(hasPerms)]} permissions`, async ({ invitationsPage }) => {
     const viewToggle = invitationsPage.locator('.toggle-view-container');
     await viewToggle.locator('.pki-button').click();
-    const container = invitationsPage.locator('.invitations-container');
-    const rootCertPopup = container.locator('.root-certificate');
-    await expect(rootCertPopup).toBeVisible();
-    await setRootCertificate(invitationsPage, path.join(testInfo.config.rootDir, 'data/public_key.pem'));
-    await expect(rootCertPopup).toBeHidden();
-    const reqs = container.locator('.pkiRequests-container-list').locator('.pkiRequest-list-item');
-    await expect(reqs).toHaveCount(3);
-    const modal = invitationsPage.locator('.select-profile-modal');
-    await expect(modal).toBeHidden();
-    const actions = reqs.nth(0).locator('.pkiRequest-actions').locator('ion-button');
-    await actions.nth(0).click();
-    await answerQuestion(invitationsPage, answer, {
-      expectedNegativeText: 'Cancel',
-      expectedPositiveText: 'Confirm adding user',
-      expectedQuestionText:
-        'The certificate provided by the user does not match the root certificate. Are you sure you want to add this user?',
-      expectedTitleText: 'Adding a user with an invalid certificate',
-    });
-    if (answer) {
-      await expect(modal).toBeVisible();
-      const inputs = modal.locator('ion-input');
-      await expect(inputs.locator('input').nth(0)).toHaveValue('Gordon Freeman');
-      await expect(inputs.locator('input').nth(1)).toHaveValue('gordon.freeman@blackmesa.nm');
-      await expect(modal.locator('.dropdown-button')).toHaveText('Select a profile');
-      const dropdown = invitationsPage.locator('.dropdown-popover');
-      await expect(dropdown).toBeHidden();
-      await expect(modal.locator('#next-button')).toBeTrulyDisabled();
-      await modal.locator('.dropdown-button').click();
-      await expect(dropdown).toBeVisible();
-      await expect(dropdown.locator('.option-text__label')).toHaveText(['Administrator', 'Member', 'External']);
-      await dropdown.locator('.option-text__label').nth(0).click();
-      await expect(modal.locator('#next-button')).toBeTrulyEnabled();
-      await modal.locator('#next-button').click();
-      await expect(modal).toBeHidden();
-      await expect(invitationsPage).toShowToast('This request has been accepted', 'Success');
+
+    if (hasPerms) {
+      await setWriteClipboardPermission(invitationsPage.context(), true);
+    }
+    await viewToggle.locator('#copy-link-pki-request-button').click();
+    if (hasPerms) {
+      await expect(invitationsPage).toShowToast('PKI link has been copied to clipboard.', 'Info');
+      expect(await getClipboardText(invitationsPage)).toMatch(/^parsec3:\/\/.+$/);
     } else {
-      await expect(modal).toBeHidden();
+      await expect(invitationsPage).toShowToast(
+        'Failed to copy the link. Your browser or device does not seem to support copy/paste.',
+        'Error',
+      );
     }
   });
 }
 
-msTest.skip('PKI requests reject request', async ({ invitationsPage }, testInfo: TestInfo) => {
+msTest('PKI requests reject request', async ({ invitationsPage }) => {
   const viewToggle = invitationsPage.locator('.toggle-view-container');
+
+  await expect(viewToggle.locator('.email-button')).toHaveText('Email invitation1');
+  await expect(viewToggle.locator('.pki-button')).toHaveText('PKI requests6');
   await viewToggle.locator('.pki-button').click();
+
   const container = invitationsPage.locator('.invitations-container');
   const rootCertPopup = container.locator('.root-certificate');
-  await expect(rootCertPopup).toBeVisible();
-  await setRootCertificate(invitationsPage, path.join(testInfo.config.rootDir, 'data/public_key.pem'));
+  await rootCertPopup.locator('ion-button').click();
   await expect(rootCertPopup).toBeHidden();
-  const reqs = container.locator('.pkiRequests-container-list').locator('.pkiRequest-list-item');
-  await expect(reqs).toHaveCount(3);
-  const actions = reqs.nth(0).locator('.pkiRequest-actions').locator('ion-button');
-  await actions.nth(1).click();
+
+  const invalidRequests = container.locator('.pkiRequests-container-list').locator('.invalid-request');
+  await expect(invalidRequests).toHaveCount(5);
+  await invalidRequests.nth(0).locator('.invalid-request__button').click();
   await expect(invitationsPage).toShowToast('This request has been rejected', 'Info');
 });