Fix: CAC Certificate Shows as Untrusted in All Browsers

Seeing “certificate untrusted” errors across all browsers when accessing DoD websites with your CAC is one of the most frustrating issues military personnel and DoD civilians face. Unlike browser-specific certificate errors, untrusted certificate warnings appearing in Chrome, Firefox, Edge, and Safari simultaneously indicate a root certificate problem – your computer doesn’t trust the DoD certificate authorities that issued your CAC certificates.

This comprehensive guide explains why CAC certificates show as untrusted, how to fix the root certificate trust chain using InstallRoot, troubleshooting when InstallRoot doesn’t resolve the issue, and preventing future untrusted certificate errors.

Understanding “Certificate Untrusted” Errors

What “Untrusted” Means

When your browser shows “certificate untrusted,” it means:

Your CAC has valid certificates
Your CAC reader is working properly
Your computer can read the CAC certificates
BUT: Your computer doesn’t trust the certificate authority (CA) that issued those certificates

Analogy: It’s like having a driver’s license from a state your employer doesn’t recognize as valid – the license itself is real, but not trusted.

Certificate Trust Chains

Digital certificates use hierarchical trust:

Root CA: DoD Root CA 3, 4, 5 (top of trust chain)
Intermediate CA: DoD ID CA, DoD Email CA (middle of chain)
End-entity certificate: Your personal CAC certificate (bottom of chain)

Your computer must trust the root CA to trust certificates issued by intermediate CAs, which in turn validates your personal CAC certificate.

If root CA is missing or not trusted: Entire chain fails, all CAC certificates show as untrusted.

Common “Untrusted” Error Messages

Chrome: “NET::ERR_CERT_AUTHORITY_INVALID” – Your connection is not private
Firefox: “SEC_ERROR_UNKNOWN_ISSUER” – The certificate is not trusted because the issuer certificate is unknown
Edge: “DLG_FLAGS_SEC_CERT_CN_INVALID” – This site is not secure
Safari: “This Connection Is Not Private” – Safari can’t verify the identity of the website
Outlook: “Certificate is not trusted” – Cannot establish secure connection

Key indicator this is a root certificate issue: Error appears across all browsers and applications, not just one.

Why DoD Root Certificates Go Missing

Common Causes

Fresh Windows install: New computers don’t include DoD root certificates
Windows reinstall/reset: Wipes all DoD certificates
Certificate expiration: Old root certificates expire periodically
Certificate policy updates: DoD migrates to new certificate authorities
Corrupted certificate store: Windows updates or crashes can corrupt store
Group Policy override: Enterprise policies may have removed certificates
Antivirus interference: Some security software strips certificates

How to Verify Root Certificates Are Missing

Windows Verification:

Press Windows + R
Type: certmgr.msc
Press Enter
Expand Trusted Root Certification Authorities → Certificates
Look for these DoD root certificates:
- DoD Root CA 3
- DoD Root CA 4
- DoD Root CA 5
- DoD Root CA 6 (newer systems)

If you see 0-2 DoD certificates: Root certificates are missing or incomplete.

If you see 10-15+ DoD certificates: Roots are installed, problem may be different (proceed to troubleshooting section).

Mac Verification:

Open Keychain Access (Applications → Utilities)
Select System keychain in left sidebar
Click Certificates category
Search for “DoD”
Should see multiple DoD Root CA certificates

Fix #1: Install DoD Root Certificates with InstallRoot

InstallRoot is the official DoD tool that installs all required root and intermediate certificates.

Step 1: Download InstallRoot

Navigate to: https://public.cyber.mil/pki-pke/tools-configuration-files/
Scroll to “PKI Tools” section
Click InstallRoot 5.x (current version as of 2025)
Download the appropriate installer:
- Windows: InstallRoot_5.x_Win.msi or .exe
- Mac: DoD PKE on Mac OS package
Save to Downloads folder

Step 2: Run InstallRoot as Administrator (Windows)

Critical: Must run as Administrator or installation will fail silently.

Navigate to Downloads folder
Right-click InstallRoot installer
Select “Run as Administrator” (not just double-click)
Click “Yes” on User Account Control prompt

Step 3: Complete Installation Wizard

InstallRoot welcome screen appears
Click “Next”
Accept license agreement
Keep default installation location
Click “Install”
Installation progress bar shows certificate installation (2-5 minutes)
You may see multiple Windows certificate prompts – click “Yes” to each
Completes with “Installation Successful” message
Click “Finish”

Step 4: Restart Computer

Required: Certificates don’t take effect until restart.

Save all work
Close all applications
Restart computer (not just sign out/sign in)

Step 5: Verify Certificate Installation

After restart:

Press Windows + R
Type: certmgr.msc
Expand Trusted Root Certification Authorities → Certificates
Should now see 10-15 DoD certificates including:
- DoD Root CA 3, 4, 5, 6
- DoD Interoperability Root CA 1, 2
- Various ECA (External Certification Authority) roots

If certificates present: Proceed to Step 6 to test.

If still missing: See troubleshooting section below.

Step 6: Test CAC Certificate Trust

Insert CAC into reader
Open browser (Chrome, Edge, Firefox)
Navigate to: https://webmail.apps.mil
Browser should prompt for certificate selection (no warning)
Select your CAC certificate
Enter PIN
Should successfully log in with no certificate warnings

Success indicators:

✓ No “untrusted” warnings
✓ Green padlock appears in address bar
✓ Certificate selection dialog appears normally
✓ Website loads after PIN entry

Mac: Install DoD Certificates in macOS Keychain

Method 1: DoD PKE Mac Package (Easiest)

Download “DoD PKE on Mac OS” from public.cyber.mil
Open downloaded .pkg file
Follow installation prompts
Authenticate with Mac password when prompted
Restart Mac after installation

Method 2: Manual Certificate Import

Download DoD certificate bundle (.zip file) from public.cyber.mil
Extract certificates
Open Keychain Access (Applications → Utilities)
Select System keychain in left sidebar
Menu: File → Import Items
Select all extracted DoD certificate files
For each imported certificate:
- Double-click certificate
- Expand “Trust” section
- Set “When using this certificate” to “Always Trust”
- Close and authenticate with password
Restart Mac

Troubleshooting: InstallRoot Didn’t Fix the Problem

Problem: Still Getting “Untrusted” Errors After InstallRoot

Solution 1: Verify Administrator Rights

InstallRoot fails silently without admin rights.

Check if you have administrator account (Settings → Accounts)
If you don’t have admin rights, contact IT help desk
On work computer, may need IT to run InstallRoot with admin credentials

Solution 2: Manually Verify Certificate Trust Settings

Certificates may be installed but not trusted.

Open certmgr.msc
Expand Trusted Root Certification Authorities → Certificates
Find DoD Root CA 3
Double-click to open
Check General tab – should say “This certificate is intended for: All issuance policies”
Check Certification Path tab – should show “This certificate is OK”
If shows error, certificate may be corrupted – proceed to reinstall

Solution 3: Clear Certificate Cache and Reinstall

Uninstall InstallRoot:
- Control Panel → Programs and Features
- Find “InstallRoot” or “DoD PKI”
- Right-click → Uninstall
Manually remove DoD certificates:
- Open certmgr.msc
- Trusted Root Certification Authorities → Certificates
- Delete all DoD certificates (right-click → Delete)
- Close certificate manager
Clear SSL state:
- Control Panel → Internet Options
- Content tab → Clear SSL State
- Click OK
Restart computer
Reinstall InstallRoot as Administrator
Restart again

Solution 4: Check for Certificate Expiration

Old DoD root certificates expire periodically.

Open certmgr.msc
Check each DoD root certificate
Look at “Expiration Date” column
If any show expiration date in the past:
- Delete expired certificates
- Reinstall InstallRoot (installs current versions)

Solution 5: Disable Antivirus Temporarily

Some antivirus programs interfere with certificate installation.

Temporarily disable antivirus (Windows Defender, Norton, McAfee, etc.)
Uninstall existing InstallRoot
Run InstallRoot installer as Administrator
Restart computer
Re-enable antivirus
Test certificate trust

Problem: Government Computer Won’t Allow InstallRoot

Cause: Group Policy restrictions prevent certificate installation.

Solution:

Contact IT Help Desk – they have administrative tools to install certificates
Provide specific error message you’re receiving
They can push certificates via Group Policy or remote installation
Do not attempt to bypass security policies

Problem: Certificates Install But Specific Website Still Shows Untrusted

Cause: Website using outdated/revoked certificate, not your CAC.

Solution:

Test other CAC-enabled sites (webmail.apps.mil, militarycac.com)
If other sites work, problem is with specific website
Report website certificate issue to website administrator
Try accessing site on different computer to verify

Fix #2: Browser-Specific Trust Settings

If InstallRoot installed certificates but browser still shows untrusted, may need browser-specific configuration.

Firefox: Manually Trust Root Certificates

Firefox uses its own certificate store, separate from Windows.

Firefox Settings → Privacy & Security
Scroll to “Certificates”
Click “View Certificates”
Click “Authorities” tab
Click “Import”
Navigate to DoD certificate bundle (from public.cyber.mil download)
Select all DoD root certificates
Check all trust boxes:
- ☑ Trust this CA to identify websites
- ☑ Trust this CA to identify email users
- ☑ Trust this CA to identify software developers
Click OK
Restart Firefox

Chrome/Edge: Verify Using Windows Certificate Store

Settings → Privacy and security → Security
Click “Manage certificates”
Verify DoD certificates appear in “Trusted Root Certification Authorities” tab
If missing, InstallRoot didn’t complete – reinstall

Fix #3: Advanced Troubleshooting

Check Certificate Revocation Issues

Sometimes browsers can’t check certificate revocation status.

Temporarily disable revocation checking:
- Control Panel → Internet Options
- Advanced tab
- Uncheck “Check for publisher’s certificate revocation”
- Uncheck “Check for server certificate revocation”
- Click OK and test
If this fixes issue: Problem is internet connectivity to DoD revocation servers
Long-term fix: Ensure firewall allows access to DoD CRL servers

Verify System Date and Time

Incorrect system clock causes certificate validation failures.

Check Windows date/time (bottom-right taskbar)
If incorrect:
- Settings → Time & Language → Date & time
- Enable “Set time automatically”
- Click “Sync now”
Restart browser and test

Why this matters: Certificates have validity periods. If system thinks it’s 2010, current certificates appear “not yet valid.” If system thinks it’s 2030, certificates appear “expired.”

Enterprise Certificate Issues

On corporate/government networks:

Proxy servers: May strip certificates during inspection
SSL inspection: Corporate firewalls inspect HTTPS traffic
Group Policy overrides: Centrally-managed policies control certificates

Solution: Contact IT help desk for enterprise-specific fixes.

Prevention: Keep Root Certificates Updated

Quarterly Maintenance

Every 3 months: Run InstallRoot to update certificates
DoD regularly updates root and intermediate certificates
Old certificates expire periodically
New certificate authorities added

Set Reminders

Calendar reminder: “Update DoD root certificates”
Frequency: Every 90 days (quarterly)
Takes 10 minutes (download, install, restart)
Prevents future untrusted certificate errors

After Major System Changes

Reinstall InstallRoot after:

Windows reinstall or major Windows update
New computer setup
Factory reset
Switching from one computer to another
After removing malware or system repair

Quick Decision Tree

Use this flowchart to determine your fix:

Check certificate manager (certmgr.msc):
- DoD root certificates present? → Go to step 2
- DoD root certificates missing? → Install InstallRoot
Certificates present but still getting errors:
- All browsers affected? → Certificates may be untrusted, clear and reinstall
- Only Firefox affected? → Import certificates into Firefox manually
After InstallRoot, still failing:
- Work computer? → Contact IT help desk (Group Policy issue)
- Personal computer? → Disable antivirus and reinstall
Works on other computers but not yours:
- Check system date/time
- Verify administrator rights
- Consider Windows reinstall if all else fails

When to Contact IT Help Desk

Contact your organization’s IT support if:

InstallRoot requires administrator rights you don’t have
Group Policy prevents certificate installation
Government computer has restrictions you can’t override
Issue persists after trying all troubleshooting steps
Multiple coworkers experiencing same issue (server problem)
Certificate errors began suddenly across organization

What to tell help desk:

Exact error message (screenshot if possible)
“Certificate untrusted” appearing in all browsers
Checked certificate manager – DoD roots missing or present
Attempted InstallRoot installation – result (success/failure/error message)
Computer type (work-issued vs personal)

Conclusion

“Certificate untrusted” errors appearing across all browsers indicate missing or corrupted DoD root certificates. The fix is installing InstallRoot – the official DoD tool that installs all required root and intermediate certificates into your computer’s certificate store.

The key steps are: download InstallRoot from public.cyber.mil, run as Administrator (critical on Windows), restart computer after installation, and verify DoD root certificates appear in certificate manager. Most untrusted certificate errors resolve within 15 minutes using this process.

If InstallRoot doesn’t resolve the issue, likely causes are insufficient administrator rights (requiring IT help desk), Firefox using separate certificate store (requiring manual import), or enterprise Group Policy restrictions (requiring IT intervention). Personal computers should resolve with clean uninstall/reinstall of InstallRoot.

Prevent future issues by running InstallRoot quarterly to keep DoD certificates current.

Related Guides: