Browser Setup

Edge, Chrome, and Safari mostly just work. Firefox needs a nudge. Here's the full picture for every browser and OS.

Last reviewed: July 2026

The one-table summary

Browser	Windows	macOS	Linux
Edge	Works natively	Works natively	Needs NSS module
Chrome	Works natively	Works natively	Needs NSS module
Safari	—	Works natively	—
Firefox	One setting	One setting	Add PKCS#11 module

"Works natively" means the browser reads certificates from the operating system's store, so once you've done your OS setup and installed the DoD certificates, there is nothing browser-specific to do.

Firefox

Firefox historically kept its own certificate world, separate from the OS. Modern Firefox can borrow the operating system's client certificates with one preference:

Open advanced preferences Type about:config in the address bar and accept the warning.
Enable OS client certificates Search for security.osclientcerts.autoload and set it to true. On Windows and macOS this makes your CAC (already known to the OS) visible to Firefox.
Trust the DoD roots Firefox also keeps its own root store. Either enable security.enterprise_roots.enabled (uses OS-installed roots), or import the DoD PEM bundle under Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import.
Restart Firefox and test Visit a CAC site; the certificate picker should now include your card.

On Linux, instead of step 2, register OpenSC as a security device: Settings → Privacy & Security → Security Devices → Load, name it OpenSC, and point it at opensc-pkcs11.so (commonly in /usr/lib/x86_64-linux-gnu/ or /usr/lib64/).

Chrome & Edge on Linux

Chromium-family browsers on Linux read client certificates from an NSS database in your home directory. Load the OpenSC module into it once and every Chromium-family browser picks it up:

# Close all Chrome/Edge windows first
modutil -dbdir sql:$HOME/.pki/nssdb \
  -add "OpenSC" -libfile /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

# Confirm
modutil -dbdir sql:$HOME/.pki/nssdb -list

Certificate picker tips

Pick the authentication certificate — the one showing your 10-digit DoD ID — for website logins.
Wrong choice cached? Browsers remember your selection per-site for the session. Fully close the browser and retry to get a fresh picker.
Multiple cards over the years? Expired identities can linger in pickers. Check the expiration date shown in the picker and choose the current one.

Internet Explorer is gone, and every "IE settings" ritual from older CAC guides went with it. If a site still claims to require IE, it will usually work in Edge — and if it truly doesn't, that's the site owner's problem to fix, not yours.

Next: signing PDFs and email.