MilitarySmartCards

DoD Certificates

Why military websites look 'untrusted' on a fresh computer, and how to install the DoD root certificates that fix it.

Last reviewed: July 2026

Why you need these

Commercial websites buy their HTTPS certificates from authorities your computer already trusts. The DoD runs its own certificate authorities, and consumer operating systems don't ship with them. Until you install the DoD root and intermediate certificates, military sites can show scary warnings, half-load, or refuse to authenticate you at all.

Only download certificates from the DoD itself. The one and only source you should use is the DoD Cyber Exchange at public.cyber.mil/pki-pke. Never install DoD certificates from a forum post, a file-sharing site, or an email attachment — a malicious "root certificate" can let an attacker impersonate any website to your computer.

Windows

On Windows, the DISA-provided installer does everything for you. It's the same tool used on official machines.

  1. Download the certificate installer Go to public.cyber.mil/pki-pke and find the current Windows certificate installation package (historically named InstallRoot) under PKI/PKE tools. Choose the non-administrative version for a home PC.
  2. Run it and install for "DoD" Accept the defaults. The tool places the DoD root and intermediate certificates into the Windows certificate store, which Edge and Chrome use automatically.
  3. Restart your browser Fully close it (check the system tray) and reopen. Certificate changes are only picked up on a fresh start.

macOS

  1. Download the PKCS#7 certificate bundle From public.cyber.mil/pki-pke, download the current "For DoD PKI Only" PKCS#7 bundle (a ZIP containing .p7b files).
  2. Verify the download The bundle's README includes SHA-256 checksums. In Terminal, run shasum -a 256 filename.p7b and compare. It takes ten seconds and rules out a corrupted or tampered file.
  3. Import into Keychain Access Open Keychain Access, select the System keychain, then drag the .p7b file in (or File → Import Items). Authenticate with your Mac password.
  4. Trust the DoD root certificates Find the DoD Root CA entries, double-click each, expand Trust, and set "When using this certificate" to Always Trust. Intermediate certificates inherit trust from the roots — you don't need to touch them.

Linux

Download the same PKCS#7 bundle as macOS, then convert and install with OpenSSL. The exact trust store location varies by distro; the short version: 

# Convert the bundle to PEM
openssl pkcs7 -in certificates_pkcs7_DoD.pem.p7b -print_certs -out dod_bundle.pem

# Debian/Ubuntu: split into individual certs in /usr/local/share/ca-certificates (*.crt), then
sudo update-ca-certificates

# Fedora/RHEL: copy the PEM to /etc/pki/ca-trust/source/anchors/ then
sudo update-ca-trust

Firefox on Linux keeps its own certificate store — see the browser guide for importing there.

How to know it worked

  • Military websites load without certificate warnings.
  • In your browser's certificate viewer, DoD sites show a chain ending at a DoD Root CA.
  • CAC login prompts appear where they used to fail silently.
Certificates age out. DISA retires old certificate authorities and stands up new ones every few years. If a site that worked for years suddenly shows trust errors, re-running the current installer or importing the latest bundle is the usual fix.

Certificates in place? Continue with your OS guide: Windows · macOS · Linux.