Troubleshooting

Work the chain in order

CAC problems live in a chain: reader → card → OS → certificates → browser → website. The fastest fix is finding the first broken link instead of changing five things at once. The sections below follow that order.

Reader not detected

• Plug the reader into the computer directly — no hubs, no docks, no monitor USB ports.
• Try a different physical port; try a different cable if it's detachable.
• Windows: Device Manager should show a "Smart card readers" section. A yellow triangle means driver trouble — let Windows Update search, or fetch the vendor's driver.
• macOS: system_profiler SPSmartCardsDataType in Terminal should list the reader.
• Linux: pcsc_scan should show the reader; if not, check that pcscd is running and libccid is installed.

Reader works, card unreadable

• Confirm orientation: gold chip up, chip-end in first (horizontal readers).
• Clean the gold contacts gently with a soft dry cloth — pocket grime is a real cause.
• Try the card in a different reader or computer if you can. If nothing reads it, the card itself may be damaged — that's an ID card office visit.
• A brand-new card that's never worked anywhere may not be properly activated — also an ID card office fix.

Card reads, but no certificate appears at login

This is the most common failure. Run this checklist top to bottom:

1. Are the DoD certificates installed? If military sites show trust warnings, do the certificate install first — the login prompt often won't appear without it.
2. Windows: is Certificate Propagation running? Services (services.msc) → Certificate Propagation → set Automatic, start it, re-insert the card. Then check certmgr.msc → Personal for your certificates.
3. Fully restart the browser Close every window (and system-tray remnant), reopen, and try again. Browsers enumerate cards at startup and cache certificate choices per session.
4. Firefox specifically? It needs its own configuration — no OS-level fix will help.
5. Old middleware installed? A stale ActivClient or vendor utility can hide the card from the native stack. Uninstall, reboot, retry.

Certificate appears, site still refuses you

• Wrong certificate picked: choose the authentication certificate (10-digit DoD ID), not an email certificate. Restart the browser to get a fresh picker.
• Account vs. card: a valid login doesn't create an account. "Access denied" after a successful PIN prompt usually means the site doesn't know you — contact that system's help desk.
• New card, old registration: some systems key on your certificate. After a card renewal, you may need to re-register your new certificate with the site (many portals have an "update my certificate" flow).
• Revoked or expired certificates: check the card's certificate dates in certmgr.msc (Windows) or Keychain (macOS). Expired card = ID card office.

PIN problems

• Not sure of the PIN? Stop at two failed tries. Attempt #3 locks the card.
• Locked or forgotten: visit any RAPIDS ID card office to reset the PIN — bring your CAC and another photo ID. There is no online, phone, or email PIN reset. Anyone offering one is scamming you.
• Find an office: use the DoD's RAPIDS appointment scheduler — see Official Resources. Book an appointment; walk-in queues are long.

When it's an ID-card-office problem

Some things can only be fixed at a RAPIDS site or through DoD self-service portals, not on your computer:

• Locked or forgotten PIN (RAPIDS, in person).
• Physically damaged, expired, or never-activated cards (RAPIDS).
• Email address changes and certificate updates (often self-service via ID Card Office Online).
• Activating the PIV authentication certificate for dual-persona users (self-service or RAPIDS).

Still stuck?

• If one specific website fails while others work, the problem is that website — use its help desk.
• If everything fails, re-run the chain from the top of this page.
• The FAQ covers the questions that don't fit a checklist.