diff --git a/src/lib.rs b/src/lib.rs
index a470410..7bbfe94 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -565,7 +565,10 @@ impl<'a, T: trussed::Client + trussed::client::Ed255> LoadedAuthenticator<'a, T>
         reply: Reply<'_, R>,
     ) -> Result {
         info!("Response for challenge ");
-        self.admin_challenge_respond(requested_alg, data, reply)
+        match self.state.runtime.take_challenge() {
+            Some(original) => self.admin_challenge_validate(requested_alg, data, original, reply),
+            None => self.admin_challenge_respond(requested_alg, data, reply),
+        }
     }
 
     pub fn admin_challenge_respond<const R: usize>(
@@ -717,7 +720,10 @@ impl<'a, T: trussed::Client + trussed::client::Ed255> LoadedAuthenticator<'a, T>
         reply: Reply<'_, R>,
     ) -> Result {
         info!("Admin witness");
-        self.admin_witness_respond(requested_alg, data, reply)
+        match self.state.runtime.take_witness() {
+            Some(original) => self.admin_witness_validate(requested_alg, data, original, reply),
+            None => self.admin_witness_respond(requested_alg, data, reply),
+        }
     }
 
     pub fn admin_witness_respond<const R: usize>(
diff --git a/tests/default_admin_key b/tests/default_admin_key
new file mode 100644
index 0000000..e4c53ad
--- /dev/null
+++ b/tests/default_admin_key
@@ -0,0 +1 @@
+



\ No newline at end of file
diff --git a/tests/opensc.rs b/tests/opensc.rs
index a119a4d..ba38dd5 100644
--- a/tests/opensc.rs
+++ b/tests/opensc.rs
@@ -5,6 +5,8 @@
 
 mod card;
 
+use std::process::Command;
+
 use card::with_vsc;
 
 use expectrl::{spawn, Eof, Regex, WaitStatus};
@@ -20,3 +22,37 @@ fn list() {
         assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
     });
 }
+
+#[test]
+fn admin_mutual() {
+    with_vsc(|| {
+        let mut command = Command::new("piv-tool");
+        command
+            .env("PIV_EXT_AUTH_KEY", "tests/default_admin_key")
+            .args(&["-A", "M:9B:03"]);
+        let mut p = expectrl::session::Session::spawn(command).unwrap();
+        p.check("Using reader with a card: Virtual PCD 00 00")
+            .unwrap();
+        p.check("Personal Identity Verification Card").unwrap();
+        p.check(Eof).unwrap();
+        assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
+    });
+}
+
+// I can't understand the error for this specific case, it may be comming from opensc and not us.
+#[test]
+#[ignore]
+fn admin_card() {
+    with_vsc(|| {
+        let mut command = Command::new("piv-tool");
+        command
+            .env("PIV_EXT_AUTH_KEY", "tests/default_admin_key")
+            .args(&["-A", "A:9B:03"]);
+        let mut p = expectrl::session::Session::spawn(command).unwrap();
+        p.check("Using reader with a card: Virtual PCD 00 00")
+            .unwrap();
+        p.check("Personal Identity Verification Card").unwrap();
+        p.check(Eof).unwrap();
+        assert_eq!(p.wait().unwrap(), WaitStatus::Exited(p.pid(), 0));
+    });
+}