Getting Started
What a CAC actually does, what you need to use one at home, and the fastest path to a working login.
Last reviewed: July 2026
What your CAC actually is
Your Common Access Card is more than an ID badge. The gold chip on the front is a tiny, tamper-resistant computer that holds your private keys and a set of digital certificates issued by the DoD. When you sign into a military website, sign a PDF, or encrypt an email, the chip does the cryptography — your keys never leave the card, and your PIN is what unlocks them.
Every CAC carries at least three certificates, and it matters which one you pick:
| Certificate | What it's for | When you'll pick it |
|---|---|---|
| Authentication | Proving who you are to websites and networks | Logging into portals and web apps — this is the one you want 95% of the time |
| Signature | Digitally signing email and documents | Signing PDFs and sending signed email |
| Encryption | Receiving encrypted email | Reading encrypted messages in Outlook |
@mail.mil / @us.af.mil style address. If a site
rejects you, the first thing to try is a different certificate from the list.
What you need
- A smart card reader Any USB CCID-compliant reader works with a CAC — most cost $10–20. Many business laptops and keyboards have one built in. See recommended readers.
- The DoD certificates Free from the DoD Cyber Exchange. Without them, your browser won't trust military websites and you'll see certificate warnings or blank pages. Install the DoD certificates.
- Your PIN The 6–8 digit PIN you chose when the card was issued. Three wrong attempts locks the card, and only an ID card office can unlock it — so if you're not sure, stop and read this first.
The fast path
For most people on a personal computer, setup is four steps:
- Plug in your reader and insert your CAC Chip end first, chip facing up on most horizontal readers. Give Windows or macOS a moment to notice it the first time.
- Install the DoD certificates Follow the certificate guide — it takes about five minutes.
- Finish your OS setup Windows usually needs nothing else. macOS and Linux need a couple of extra steps.
- Test it Open a CAC-enabled site you use (for example, your webmail or personnel portal), pick your authentication certificate when prompted, and enter your PIN.
Do I need ActivClient or other middleware?
Probably not. Modern Windows and macOS include native smart card support, and most DoD websites work fine with it. ActivClient is DoD-licensed middleware that some organizations still use on government machines, but it is not available for free download for home use, and for personal computers it's rarely necessary. If a specific application demands middleware on Linux, OpenSC is the free, open-source answer.
A note on government devices
These guides are for your personal computer. Government-furnished equipment is managed by your unit's IT staff — settings are locked down, middleware is pre-installed, and changing things yourself can violate policy. If a work machine has CAC problems, go through your help desk.