MilitarySmartCards

macOS Setup

macOS supports smart cards natively through CryptoTokenKit. Setup is mostly certificates plus one decision about card pairing.

Last reviewed: July 2026

Before you start

  • A smart card reader (USB-C readers are handy on modern Macs).
  • A supported version of macOS — anything from the last several years is fine.
  • Your CAC and PIN.
No middleware needed. macOS has shipped native smart card support (CryptoTokenKit) for years. Safari and Chrome can use your CAC out of the box once the DoD certificates are installed.

Step-by-step

  1. Connect the reader and insert your CAC To confirm the Mac sees the card, open Terminal and run system_profiler SPSmartCardsDataType. Your reader and card should be listed.
  2. Decide about the pairing dialog The first time you insert a CAC, macOS may offer to pair the card with your user account so you can log into the Mac itself with it. For using DoD websites you don't need pairing — feel free to click "Cancel." Pairing is only for replacing your Mac password with the card.
  3. Install the DoD certificates Follow the macOS section of the certificate guide: import the PKCS#7 bundle into the System keychain and set the DoD roots to Always Trust.
  4. Test in Safari or Chrome Visit a CAC-enabled site. When the certificate picker appears, choose your authentication certificate, then enter your CAC PIN (not your Mac password) at the PIN prompt.

Useful commands

# List connected readers and cards
system_profiler SPSmartCardsDataType

# See the identities on the inserted card
security list-smartcards
security export-smartcard

# If pairing was set up and you want it gone
sc_auth unpair

Common macOS quirks

  • PIN prompt says "password" — some dialogs are vague about which secret they want. If a smart card is involved, it wants the card PIN.
  • Certificate picker shows old cards — if you've had multiple CACs, Safari may list stale identities. Pick the newest (check the expiration date shown), or clear old entries from Keychain Access.
  • Firefox doesn't see the card — Firefox needs its own configuration on every OS. See the browser guide.
  • Reader dead after sleep — occasionally the reader isn't re-detected when the Mac wakes. Unplug and replug the reader, or remove and re-insert the card.

Next: browser setup or signing PDFs and email.