diff --git a/npa/src/npa-tool.c b/npa/src/npa-tool.c
index df78637..bede7fa 100644
--- a/npa/src/npa-tool.c
+++ b/npa/src/npa-tool.c
@@ -342,8 +342,12 @@ main (int argc, char **argv)
     }
     if (cmdline.tr_03110v201_flag)
         tr_version = EAC_TR_VERSION_2_01;
-    if (cmdline.disable_checks_flag)
-        npa_default_flags |= NPA_FLAG_DISABLE_CHECKS;
+    if (cmdline.disable_all_checks_flag)
+        npa_default_flags |= NPA_FLAG_DISABLE_CHECK_ALL;
+    if (cmdline.disable_ta_checks_flag)
+        npa_default_flags |= NPA_FLAG_DISABLE_CHECK_TA;
+    if (cmdline.disable_ca_checks_flag)
+        npa_default_flags |= NPA_FLAG_DISABLE_CHECK_CA;
 
 
     if (cmdline.info_flag)
diff --git a/npa/src/npa-tool.ggo.in b/npa/src/npa-tool.ggo.in
index b572b00..4cbaa5d 100644
--- a/npa/src/npa-tool.ggo.in
+++ b/npa/src/npa-tool.ggo.in
@@ -196,8 +196,14 @@ option "translate"      t
 option "tr-03110v201"    -
     "Force compliance to BSI TR-03110 version 2.01"
     flag off
-option "disable-checks"   -
-    "Disable checking fly-by-data and validity period of CV certifcates"
+option "disable-all-checks"   -
+    "Disable all checking of fly-by-data"
+    flag off
+option "disable-ta-checks"   -
+    "Disable checking the validity period of CV certifcates"
+    flag off
+option "disable-ca-checks"   -
+    "Disable passive authentication"
     flag off
 
 text "
diff --git a/npa/src/npa.c b/npa/src/npa.c
index f2eb1c4..6aeb8f9 100644
--- a/npa/src/npa.c
+++ b/npa/src/npa.c
@@ -306,8 +306,10 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
     out->auxiliary_data = NULL;
 
     out->flags = npa_default_flags;
-    if (out->flags & NPA_FLAG_DISABLE_CHECKS)
+    if (out->flags & NPA_FLAG_DISABLE_CHECK_TA)
         TA_disable_checks(out->ctx);
+    if (out->flags & NPA_FLAG_DISABLE_CHECK_CA)
+        CA_disable_passive_authentication(out->ctx);
 
     return out;
 
@@ -2250,7 +2252,7 @@ npa_sm_pre_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx,
     }
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
+    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) {
         if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) {
             /* PSO:Verify Certificate
              * check certificate description to match given certificate */
@@ -2443,7 +2445,7 @@ npa_sm_finish(sc_card_t *card, const struct iso_sm_ctx *ctx,
                 SC_ERROR_INVALID_ARGUMENTS);
     struct npa_sm_ctx *eacsmctx = ctx->priv_data;
 
-    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
+    if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) {
         if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) {
             if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00
                     && apdu->le == 8 && apdu->resplen == 8) {
diff --git a/npa/src/npa/npa.h b/npa/src/npa/npa.h
index 04806e2..eccda80 100644
--- a/npa/src/npa/npa.h
+++ b/npa/src/npa/npa.h
@@ -213,13 +213,12 @@ int npa_reset_retry_counter(sc_card_t *card,
 #define npa_change_pin(card, newp, newplen) \
     npa_reset_retry_counter(card, PACE_PIN, 1, newp, newplen)
 
-/**
- * @brief Disable all sanity checks done by OpenPACE
- *
- * Currently used to set \c TA_FLAG_SKIP_TIMECHECK (Skip checking effective and
- * expiration date of cv certificates against the system's current time).
- */
-#define NPA_FLAG_DISABLE_CHECKS 1
+/** @brief Disable all sanity checks done by libnpa */
+#define NPA_FLAG_DISABLE_CHECK_ALL 1
+/** Disable checking validity period of CV certificates */
+#define NPA_FLAG_DISABLE_CHECK_TA 2
+/** Disable checking passive authentication during CA */
+#define NPA_FLAG_DISABLE_CHECK_CA 4
 
 /** Use \c npa_default_flags to disable checks for EAC/SM */
 extern char npa_default_flags;
diff --git a/npa/test_vicc_with_npa-tool.sh b/npa/test_vicc_with_npa-tool.sh
index 1fc5b8f..490d8fe 100755
--- a/npa/test_vicc_with_npa-tool.sh
+++ b/npa/test_vicc_with_npa-tool.sh
@@ -64,7 +64,7 @@ do
         --older-than=19991231 --verify-validity \
         --read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \
         --write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \
-        --disable-checks
+        --disable-ta-check --disable-ca-check
     NPA_RESULT=$?
 
     kill $VICC_PID 2>/dev/null