CAC Issue Library

Adobe Reader is installed but signing options are greyed out on macOS 10.12+.

When signing a PDF with your CAC, Adobe Reader DC throws: 'The Windows Cryptographic Service Provider reported an error: Key does not exist. Error Code: 2148073485'.

Signing a PDF returns: 'The Windows Cryptographic Service Provider reported an error: The keyset is not defined. Error Code: 2148073497'.

Signature attempt fails with a message about insufficient storage on the smart card.

A form that should support digital signatures opens without the pink signature ribbon icon, leaving signature fields unusable.

Adobe reports the security token has no storage space.

Cannot find a CAC reader/middleware app that authenticates an Android phone or tablet to DoD sites.

Generic 'can't be displayed' message on CAC URL.

AKO refuses to let you download ActivClient.

Cannot download files from CAC sites in IE.

ATAAPS will not load for CAC-25 or newer users.

Chrome/Firefox/IE returns net::ERR_SSL_PROTOCOL_ERROR.

Browser returns ERR_BAD_SSL_CLIENT_AUTH_CERT.

Browser loops through redirects on a CAC site.

Firefox throws ssl_error_bad_cert_alert when attempting CAC authentication.

Firefox repeatedly prompts for a 'master password'.

Firefox prompts no certificate, or no security device is listed for the CAC.

Firefox throws an SSL renegotiation error on a CAC-enabled DoD site.

Safari loops between redirects on a CAC site.

Army 365 (or any PIV-required site) does not show an 'Authentication' certificate in the picker.

Cannot authenticate to DoD sites on Mac even after installing the AllCerts bundle.

Browser prompts for a certificate but the list is empty, or no prompt appears at all and the page returns 403.7.

Newly installed DoD Root CA shows a red circle with white X in Keychain Access.

Windows webmail returns 12221.

Activation or login returns Error 38.

Browser returns 403.7 when reaching a CAC site.

Webmail or other CAC sites return 'Error Code: 500 Internal Server Error' or 'Certificate is revoked'.

Error 53 on PIV activation or login.

Signed/encrypted email partially works but coworkers cannot encrypt to you for ~24 hours after a new CAC.

An email displays a 'Common Policy' install popup; clicking Yes breaks ATAAPS.

Email cert lists an old or wrong address (e.g. legacy @us.army.mil instead of @mail.mil), causing GAL/Exchange mismatches.

Citrix-based virtual desktops (Air Force Desktop Anywhere, Navy Nautilus) and Azure Virtual Desktop refuse to launch on ChromeOS.

Installed certificates do not appear in Chrome; CAC sites still throw cert errors.

After April 1, 2025, the previously working DriveLock + Smart Card Connector extensions stopped functioning.

OWA throws an ActiveX-required message.

OWA refuses to render an attachment.

Outlook LDAP address book fails to connect.

Outlook returns 'Invalid certificate' when sending.

Encrypted message will not open in OWA, and the smart card prompt may reappear.

Outlook throws 'No digital ID for signing has been found' when sending encrypted email, especially for users with both military and civilian CACs.

OWA throws a pop-up-blocker error even after disabling browser pop-up blockers.

Signed messages open but show a signature validation error.

After a CAC swap, OWA insists the wrong card is in the reader.

Outlook refuses to encrypt to a specific person.

On a home/non-managed computer, opening Army 365 webmail blocks attachment download and print with the message: 'Your organization doesn't allow you to download or print attachments from this device or browser.'

OWA refuses to encrypt/sign because the S/MIME control is out of date.

Enterprise Email or another DoD site refuses login with an F5 session error.

AF Portal complains the browser cannot access the CAC.

AF Portal returns 'Your CA was not recognized. Contact your CSA/LAN support team for assistance with DoD certs.'

AKO or AMID throws 'Insert card' although ActivClient sees the CAC fine.

CAC sites (most commonly webmail) fail to load, hang, or strip out the CAC prompt; disabling the antivirus temporarily makes the site work.

AROWS (Air Force) or NROWS (Navy) stops at the login page with a browser-incompatible error on macOS.

AVD that previously worked on macOS now fails to authenticate after a Microsoft Remote Desktop update or password rotation.

CAC will not authenticate; PIN prompts loop or return 'PIN incorrect' immediately even with the right PIN.

CAC is read by the Mac but the AVD session never sees it; no certificate prompt inside the virtual desktop.

AMID rejects the CAC login.

Coast Guard VDI rejects connection from old VMware Horizon clients.

DTS login fails with DBSign error 112 'Certificate invalid or expired'.

User unsure whether to buy TwoCanoes/PKard or Identiv iAuthenticate.

Need to access a CAC site from an iPhone or iPad and the cert picker never appears.

Trying to use the kyle.gorak.us iOS CAC method fails.

Lightning-only reader will not attach to a USB-C iPad Pro.

Authentication takes 10-15+ seconds or times out with CACkey.

Firefox works after loading the PKCS#11 module but Chrome still does not prompt for a certificate.

Enterprise Email refuses to authenticate; only the legacy ID cert is visible.

After switching from CACkey to CoolKey (or vice versa), DTS / DBSign refuses to authenticate.

DTS website opens but the application never starts; Java errors may appear.

Chrome CAC setup fails because /usr/lib64 does not exist or the module is in a multi-arch directory.

pcsc_scan shows no reader; nothing happens when inserting/removing the CAC.

After installing a new middleware, the old module is still active and the browser uses the wrong one.

ActivClient on macOS Catalina 10.15.7 will not authenticate.

macOS prompts to 'pair' the CAC to your account. If you pair and then fail PIN attempts, the CAC gets blocked.

After picking a certificate, a 'keychain password' dialog appears.

CAC works until Cisco AnyConnect is launched.

After clicking into an Authorization or Voucher in DTS, Safari renders a blank page.

Adding a DoD cert to the keychain fails with 100001.

Mac webmail throws 12221.

After installing certs and enabling native smart card, Firefox still fails to authenticate.

Firefox on Mac will not present a CAC cert because the DoD certs are not in Firefox's own NSS store.

After upgrading to Big Sur, the Mac no longer accepts the admin password and the CAC stopped working.

CAC works at first, but eventually macOS stops seeing the certs until you reboot.

A previously-working CAC site is suddenly unreachable on the Mac with no obvious change.

The DMDC self-service PIV activation fails on macOS, Linux, or in Chrome.

Error 5011 during PIV activation.

After completing the PIV activation, the cert displays a '.letter' suffix after the DoD ID and Army systems reject it.

PIV activation breaks at the DMDC site without ActivClient.

PIV activation throws Error 4012.

PIV activation times out (Error 4015, 4017, 4019, 4022, 4023, 4024).

Error 4020 at PIV activation.

Activation returns 4027, 4028, or 4034 from the LCM user portal.

Login fails or redirects strangely because you keep picking the wrong certificate type.

Computers with a built-in CAC reader (some Gateway, some HP laptops) plus an external reader throw 'smart card no more available' on AC 6.1.

ACR39U does not read G+D FIPS 201 SCE 7.0 or Gemalto DLGX4 128Kv2 on Windows 10.

Reader is plugged in but missing entirely from Device Manager, or shows as an unknown device.

Cloud 2700R is unsupported on these OS versions.

Older IO Gear reader fails to read G+D FIPS 201 SCE 7.0 or Gemalto DLGX4 128Kv2 CACs.

Unsure whether to install an Omnikey driver on modern macOS.

On boot or login, the system plays a beep tied to the empty CAC reader.

CAC works sometimes; other times the system fails to detect the card or drops it mid-session.

Rocketek RT-SCR10 or Opluz OPM610 are detected as readers but do not read a CAC.

SCR-331 fails on Gemalto TOP DL GX4 or Oberthur 5.5 Dual cards, or shows up as 'STCII Smart Card Reader' or 'USB Smart Card Reader'.

SCR-3310 v1 stops working on newer Windows or Mac.

SCR-3310 v2.0 is detected but cannot read G+D FIPS 201 SCE 7.0 or Gemalto DLGX4 128Kv2 CACs.

After installing ApproveIt, Word 2007 or Excel 2007 has no ApproveIt ribbon tab.

ApproveIt ribbon not visible in newer Office, or it appears in 32-bit Office but not 64-bit Office.

NCOER or other DoD PDF-F documents either fail to open or refuse to sign on Mac.

Lotus Forms shows the signature line but cannot verify existing signatures.

Opening a Lotus Forms / IBM Forms document throws an internal null-pointer error.

Lotus Forms 4.0.0.477 throws 'Computer does not have required file installed (Toolbar IFX)'.

CAC works locally but the remote session over RDP cannot see the reader.

Cannot log onto government computer with CAC; error mentions a missing key container.

Error 0x80004005 during ActivClient install on Vista.

Setup aborts with Error 1316.

Personal certs from someone else's CAC remain in the user store after they remove their card.

CAC worked on Windows 8.1 but does not on Windows 10.

Inserting CAC at the lock screen returns 'The system could not log you on. Your credentials could not be verified.'

Browser keeps picking an old cert from a prior CAC.

Cannot access certain CAC sites due to leftover bad certs after multiple CAC issuances.

Windows asks for the CAC PIN on every CAC site.

DoD civilian employee cannot locate the ActivClient installer because there is no centralized civilian download.

DTS login hangs at the DBSign loading bar or returns a security info error.