The Department of Defense (DoD) uses smart identity cards to verify employees and provide multifactor authentication. The CAC, also known as the Common Access Card, contains a microprocessor with PKI certificates that allow a person to digitally sign documents using a PIN code, encrypt/decrypt emails, and securely connect to online networks. It also stores other personal information, including personnel categories, rank, and pay grade.
To use a CAC, a person inserts it into a reader and then enters a PIN. The reader sends the EDIPI number from the CAC to a system for verification. The system then compares it against a database of authorized users to determine whether the person is allowed to access certain systems.
To get started, ensure your CAC reader works for PC and that you have the right ActivClient installed (Army / AFSC) or are logged on to the PITD site. If your ActivClient or computer can’t see the card, you may need a new CAC card. You can check the RAPIDS ID card office website for more info.
How Do I Make My CAC Certificates Available to W11?
The simplest way to make your CAC certificates available to Windows 11 is by using the built-in Certificate Manager tool. To open the Certificate Manager, type cert into the Cortana search bar to pull up a control panel result for managing certificates on your computer. The window will be titled certlm, which stands for certificates on your local machine.
The Certificate Manager allows you to import, export, and remove certificates from your computer. You can also view the trust hierarchy and the status of a certificate. You can even set a default certificate to use for your web browser and other applications.
You can also use the Certificate Troubleshooting Instructions to resolve any issues you might have. You should read these instructions before making changes to your system.
You can also contact your agency’s IT department for help. In addition, it’s important to note that your CAC or PIV card is the property of the U.S. Government and that mishandling it can lead to a fine or imprisonment. To prevent this from happening, be sure to follow all the security precautions provided by your agency.
Where Can I Download DoD Certificates?
If you do not install DoD certificates to your computer, you will get a security warning when accessing certain servers because they have not been verified by the certificate authority. This is why it is important that you have these certificates installed. Normally, you will have to add each servers certificate manually on a site-by-site basis, but NDU has created a profile that will automatically install the DoD root and intermediate certificates to your computer. This is a great time saver and will ensure you have all the certificates needed to access DoD sites.
To install the certificates, simply follow the steps outlined in this DoD PKE tool (installs DoD root certificates) (32-bit, 64-bit, or Non-Administrator). You can also download these certificates from the AKO/DKO portal by clicking on CAC Certificate Installation Quick Start under the CAC Resource Center button. If you have any questions regarding the certificates or installing them on your computer, please contact the NDU CAC Support Team. They can help you with any of your questions or problems with accessing DoD websites or other applications.
How do I Add a CAC Certificate to My Computer?
If you have a CAC card reader, plugin it to your computer and launch PuTTY-CAC. This will add a Pageant icon to your taskbar; it does not open a window.
Once you have the certificates on your computer, you can visit any DoD website that requires CAC authentication. However, if the web site won’t load or is prompting you with a security warning or indicating that the website’s certificate has expired or does not match, your PC may be missing the necessary certificates.
Starting with version 9.32 of Service Manager, the Service Manager server and web client support CAC sign-on. When configured, this enables users to log on to the web client directly from their CAC by using a Microsoft Windows logon compatible certificate and a CAC card PIN rather than a user name and password. To enable CAC sign-on in a web tier, both the web application server and the Windows client must support two-way SSL authentication. Also, the user’s CAC must contain a personal certificate that is Microsoft Windows logon compatible. This certificate is loaded by the smart card middleware, such as ActivClient.