Linux & ChromeOS Setup

OpenSC and pcscd bring full CAC support to virtually every distro. ChromeOS works too, with Google's Smart Card Connector.

Last reviewed: July 2026

Linux: the three pieces

CAC support on Linux is three small, standard components:

pcscd — the daemon that talks to your USB reader.
OpenSC — open-source middleware that understands CAC/PIV cards and exposes them via PKCS#11.
The DoD certificates — same trust anchors as every other OS.

Step-by-step (Debian/Ubuntu shown)

Install the packages
```
sudo apt install pcscd pcsc-tools opensc opensc-pkcs11
```
Fedora/RHEL: sudo dnf install pcsc-lite pcsc-tools opensc. Arch: sudo pacman -S pcsclite ccid opensc.

Start the smart card service

sudo systemctl enable --now pcscd.service pcscd.socket

Verify the reader sees your card Insert the CAC and run pcsc_scan. You should see your reader and a card ATR within a few seconds — press Ctrl+C to exit. Then confirm OpenSC can read it:
```
pkcs11-tool --list-slots
pkcs11-tool --list-objects --type cert
```
Install the DoD certificates Follow the Linux section of the certificate guide for the system trust store.
Point your browser at OpenSC Chrome/Chromium and Firefox on Linux use NSS databases rather than the system store. Load the OpenSC PKCS#11 module — details in the browser guide, or the quick version for Chrome:
```
modutil -dbdir sql:$HOME/.pki/nssdb \
  -add "OpenSC" -libfile /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
```
(Close the browser first; the library path varies by distro.)
Test a login Open a CAC-enabled site, pick your authentication certificate, enter your PIN.

Careful with PIN attempts on the command line. Tools like pkcs11-tool --login count against the same three-strike lockout as everything else. Scripts that retry automatically can lock your card in seconds — never loop a login.

ChromeOS

Install Google's Smart Card Connector From the Chrome Web Store — this is Google's own PC/SC implementation for ChromeOS.
Add certificate provider middleware The Connector alone is just plumbing; you also need a certificate provider extension that understands CAC/PIV to surface your certificates to Chrome.
Install the DoD certificates In Chrome: Settings → Privacy and security → Security → Manage certificates → Authorities → Import the DoD PEM bundle.

ChromeOS reality check: basic website logins generally work; anything beyond that (signing PDFs, encrypted email) is limited. If your daily driver is a Chromebook, keep expectations modest and a real computer within reach.

Common Linux issues

pcsc_scan shows nothing: the ccid driver may be missing (libccid package), or pcscd isn't running.
Card visible but no certs listed: your card may be a newer variant needing a current OpenSC — upgrade OpenSC before anything else.
Firefox ignores the card: the PKCS#11 module must be added inside Firefox itself — see the browser guide.
Works as root but not as you: check that your user is in the right group for the reader device, or that no other process (like a stale gpg-agent with scdaemon) is holding the reader exclusively. fuser -v /dev/bus/usb/*/* can reveal the culprit.

Next: browser setup.