NOTE: For Macs running Mac OS 10.15.6, once you've installed the above VMware Horizon program, you will need to make a slight adjustment. In the top bar select the program name, Preferences, Security, and select a button that states: 'Do not verify identities.'
WINDOWS 10 & 8.1 USERS:If your CAC a 'GEMALTO TOP DL GX4144,' 'GEMALTO DLGX4-A 144,' 'Oberthur ID One 128 v5.5 Dual', 'Oberthur ID One 128 v5.5a D' or 'G&D FIPS 201 SCE 3.2' or 'G+D FIPS 201 SCE 7.0' you 'may' be able to use your CAC without needing to install ActivClient.
Read more about the older CACs and how to replace them
Here are more options for you (if the above didn't work)
ACTIVCLIENT INSTALLATION PROBLEMS AND SOLUTIONS
Air Force users, download Lotus forms from:
Download 'AFDPO Releases Updated IBM Lotus Viewer_DSign_3.5.1.333.exe' under Software link
OTHER AIR FORCE SPECIFIC PROBLEMS:
Problem 1: Receiving 'Your CA was not recognized. You should contact your CSA/LAN support team for assistance with DoD certs on this computer. You can install the latest DoD certs from...' error message when attempting to access the AF Portal
Information:The Cross Cert remover tool removes certificates which cause the cross-certificate chaining issue from Microsoft Local Computer and User Certificate stores. This will prevent your certificate from appearing to be issued by roots other than DoD Root CA 2 and being denied access to DoD websites. Some computers may have the Federal Bridge Certificate Authority's DoD Root CA 2 certificate installed. This conflicts with the DoD's DoD Root CA 2. You must remove the DoD Root CA 2 signed by the DoD Intermediate Root CA 1 in order to use the AF Portal with your CAC.
.
Cure 1-1: Follow the guidance in this PDF, slide 15 has download links for the Cross Cert remover tool.
.
Cure 1-2: If [after following guidance above] you're still having problems, go from this direct link: https://www.my.af.mil
.
.
.
Problem 2: Air Force users receiving 'There was a problem with this browser accessing your CAC for authentication. You may have pressed 'cancel' button in your browser's certificate selection prompt. If you are trying to authenticate with your CAC, please clear your SSL sessions. In IE go to the Tools-Internet options. Select the content tab and press the 'Clear SSL State button.' If this does not work or you are unable to complete this close all open browser windows and try again.
.
Cure 2-1: Verify your clock settings on your computer. One person's battery had died, and his clock was set for November 2011, when it was actually August 2012.
.
.
.
Problem 3: Air Force users seeing strange error message when using Outlook Web Access 2003 with Internet Explorer 10 or 11
.
Cure 3-1: See here for solution.
.
.
.
Problem 4: Air Force users with OS X 10.9.x Mavericks and newer having problems accessing https://leave.af.mil or https://www.my.af.mil/leavewebprod/login follow same guidance as DTS users via the DTS page.
.
.
.
Problem 5: Air Force webmail constantly getting the message The page cannot be displayed
Cure 5-1: Follow this guide to find out how to add https://*.mail.us.af.mil to your trusted sites
INFORMATION FOR APPLE MAC USERS ONLY
NOTE: In order to access some of the Air Force CAC-enabled websites, you must CANCEL when it first asks for your PIN. After canceling, then choose your certificate, it will give you a second opportunity to enter your PIN. NOW enter your PIN.
Information for Air Force personnel using Apple Computers: AROWS will not continue to the login page if it identifies your browser as non-compatible. This is easily fixed by having Safari report it 'is' IE. Go to Safari->Preferences ->Advanced and ensure the 'Show develop menu' check box is ticked. Now when you open NROWS and it gives the browser error, go to the Develop menu in the menu bar and select User Agent->Internet Explorer (any version 6.0 or greater) The 'Unsupported' page will refresh, Now paste the URL below back into the web browser again, you should be back at the login screen. This should work from the air Force Portal, or directly at the URL: https://arowsr.afrc.af.mil/arows-r
Try using User-Agent Switcher for Chrome
You can try this as well for AROWS, but, you'll need Google Chrome:
NROWS sets some narrow parameters when it comes to User Agent identification. Thursby software has figured this out. You'll need to build an AppleScript and use Google Chrome as your browser:
The first step is to build the AppleScript.
- Open Utilities > AppleScript Editor.
- Paste the code from below.
- Choose File > Save As…
- Select File Format: Application.
- Give the item a name and save.
- Then run the app.
Code:
set myURL to 'https://arowsr.afrc.af.mil/arows-r'
tell application 'System Events'
set processList to name of every process
end tell
if processList contains 'Google Chrome' then
beep
set theReturnedItems to (display dialog 'Google Chrome is already running.' & return & 'Would you like to quit and relaunch it?' default button 'Cancel')
set theButtonName to the button returned of theReturnedItems
-- If user clicks 'Cancel', this part of the script is never executed.
end if
-- This gets the path to Google Chrome. Unfortunately, it also launches the app.
set myGoogleChromePath to POSIX path of (path to application 'Google Chrome')
tell application 'Google Chrome' to quit
delay 1
set myCommand to 'open ' & quoted form of (myGoogleChromePath)
set myAgent to '--args -user-agent='Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:2.0) Gecko/20110307 Firefox/4.0'
set myscript to myCommand & ' ' & myAgent & ' ' & myURL
do shell script myscript
Safari keeps crashing
An Air Force person emailed this fix to me: He would load his OWA, and the window would only stay open for about 10-20 seconds before OWA tried to open a calendar popup reminder. This popup would crash his Safari window, leading him to a frustrating 'Safari quite unexpectedly' error message. He could access other CAC websites like Air Force Portal, DTS, Leaveweb, and ADLS. He found a workaround while searching through Thursby forum that had the idea of going to Options, Accessibility, selecting Use the blind and low vision experience. This disabled the annoying calendar popup, now his OWA window no longer crashes Safari. He mentioned the visual experience is more basic now, but at least he can access his email.
When it comes to installing your new CAC reader onto your home computer, there’s a doubt that installing on Mac is much more complicated. Often, you’ll need to install a CAC Enabler just for your Mac to recognize the hardware. But don’t worry in this handy guide, we’ll walk you through how to install a CAC enabler for Mac and which one to choose.
Here’s the thing…. Mac has many different OS’s which means that there are many different CAC enablers. And some will work for particularly OS’s only.
MUST READ IMPORTANT INFO BEFORE YOU BEGIN
Before you get started downloading and installing your CAC Enabler, there is some information that you need to be aware of:
- Only download and install ONE CAC Enabler. Multiple CAC Enablers can cause your CAC Card reader not to work. If you currently have an incorrect CAC enabler installed, you need to uninstall and remove it before getting the correct one. This includes built-in Smart Card Readers for the newer OS’s.
- Some of these CAC Enablers will ask for a Keychain Password. You should already have this information. It’s your CAC PIN. But before you enter this information, make sure you’ve already selected your CAC Certificate. And you need to use your full CAC pin. Failure to do so can actually lead to you getting locked out of your CAC Card. If this happens, you’ll have to go to your nearest ID Card Office or PSD to get it unblocked.
- After successfully installing your CAC Enabler, you need to restart your computer before trying to access any CAC protected site. This ensures that your computer has properly recognized and installed the CAC Enabler.
- Just because you’ve properly installed and set up your enabler, that doesn’t mean that it will work with all browsers–particularly Firefox. As popular of a browser it is, Firefox is notorious for not allowing CAC-protected sites to be accessed. This is why I recommend using Google Chrome. It has the least obstructions for you when it comes to using your CAC Reader.
What CAC Enabler Do You Need For Your OS?
In order to make sure that you download the right OS, be sure to use our handy Table of Contents to jump to the proper section.
And with that, let’s get your Mac system CAC Card ready!
Catalina (10.15.x)
If you’ve purchased a Mac with the Catalina OS installed, STOP RIGHT HERE.
Catalina comes pre-equipped with a built-in CAC Enabler. This means you do not need to install a third-party program. If you do, it may interfere with your built-in enabler and cause your CAC to not be recognized. Just be sure that you have the proper DOD certificates installed.
Download Cac Card Certificates For Mac
But what if you purchased your Mac and then upgraded to the new system?
If you haven’t installed any third-party enablers, the built-in function should automatically start working. But if you have previously installed any third-party CAC enablers, you’re going to have to uninstall and completely remove those first.
Mojave (10.14.x)
Similar to the Catalina OS, Mojave also has a built-in Smart Card Reader. This means that a third-party CAC enabler program may not be necessary. So before downloading any other enabler, test out the built-in first–just make sure you have the proper DOD certificates needed.
If your Mojave’s built-in reader is not working, then you can proceed to pick up another CAC enabler. There are 4 verified readers that work for Mojave that we know of.
Each of these should work for any type of CAC Card.
High Sierra (10.13.x)
High Sierra is another Mac OS with a built-in Smart Card reader. However, unlike Mojave or Catalina, you cannot access CAC-protected sites through Safari. They are not supported through Safari in this OS.
You need to use Google Chrome for optimal results. If you are adamantly opposed to using Chrome, I’d recommend to go ahead and update your Mac OS to Mojave or Catalina (if supported). Afterwards, you should find you don’t need a CAC enabler as long as you have the proper certificates.
However, if things aren’t working out the way they should, you do have some options for third party CAC enablers.
These have been verified to work with High Sierra and with every CAC Card type we’ve come across.
Sierra (10.12.x)
Sierra is the last of the Mac OS’s that has a built-in Smart Card Reader. However, you need to be aware that this reader will not function with the Safari browser even with the proper certificates.
You’ll need to utilize Google Chrome along with the proper DOD (or other) certificates.
There have been reports of the Sierra built-in CAC reader failing to operate properly. And in that case, you’re going to need to download one of these verified CAC enablers:
These CAC Enablers work with every type of CAC Card.
One thing to note is that if you decide to utilize PKard with Sierra, you need to make sure that you’re using PKard version 1.7 or higher.
El Capitan (10.11.x)
Unlike its newer OS counterparts, El Capitan does not come with a built-in smart card reader. You will be required to download and install a third-party program. Thankfully, there are 5 different CAC Enablers you can use.
One thing to note is that Smart Card Services will not work with all types of CAC Cards. If your CAC Card is designated as Oberthur ID One 128 v5.5a D, Smart Card Services cannot read it. You can find this information on the back of your CAC card itself near the magnetic strip.
This can be solved one of two ways. Either opt for a different enabler or get a new CAC Card.
Yosemite (10.10.x)
Yosemite requires a third-party enabler to be installed in order for your CAC Card to be recognized. There are 5 different verified options for Yosemite users:
Although a verified option, we recommend against using Smart Card Services. The reason for this is that Smart Card Services doesn’t accept all types of CAC Cards–particularly those labeled Oberthur ID One 128 v5.5a D.
Mavericks (10.9.x)
Mavericks is another Mac OS without a built-in Smart Card Reader. This means that you’re going to need to download a CAC Card Enabler. We’ve found five different platforms that work with this OS.
However, we suggest steering clear of Smart Card Services if you’re carrying the Oberthur ID One 128 v5.5a D CAC Card. This enabler does not recognize this particular type of CAC Card.
Mountain Lion (10.8.x)
Since Mountain Lion OS has no built-in Smart Card Reader, you’ll have to avail of a third-party CAC Card Enabler. There are 5 different options to choose from for this platform.
However, if you’re using the CAC Card type, Oberthur ID One 128 v5.5a D, steer clear of Smart Card Services. They don’t recognize this type of card.
Lion (10.7.x)
Lion is one of Mac’s older operating systems. But that doesn’t mean you’re completely out of luck if need to use a CAC card on it. There are 4 different options you have.
It’s worth mentioning that if you are planning on using Smart Cards Services, ensure you don’t have an Oberthur ID One 128 v5.5a D CAC Card. The program doesn’t work with the typing.
Snow Leopard (10.6.x)
The first recommendation I have for Snow Leopard users is to upgrade their system as soon as possible. But if due to constraints you are unable to, there are still a few paths you can take when it comes to ensuring your CAC Card can be read.
Just don’t opt for Smart Card Services if you’re using an Oberthur ID One 128 v5.5a D CAC Card.
Leopard (10.5.x)
If you’re still using Leopard, our first recommendation is to upgrade your OS immediately. However if you’re unable to, there’s still hope for using a CAC Card on your computer.
Download Cac Certificate Army
Your available options for CAC Card Enabler are:
However, TENS will only work if your computer has an Intel processor. It won’t work if you’re using a PPC.
Again, the first recommendation for Leopard is not downloading a new CAC enabler but updating your system.
Our Top CAC Enabler Picks for All Operating Systems
When it comes to which enablers we like best, it boils down to two.
PKard and ActivClient for Mac.
Dod Cac Certificates Download
Either one of these is compatible with just about every OS on this list–with the exception of Catalina (Be sure to use their built-in enabler.)
Plus they have vendor support. And that can be quite handy if you’re having issues with your CAC enabler. However, they don’t come free. ActivClient for Mac rings in at around $50 while PKard is available for around $40.
