CAC Reader Troubleshooter — Fix It Step by Step

CAC reader acting up? Answer two quick questions and get an ordered fix checklist for your exact setup — Windows 11, Windows 10, Mac, or Linux. Everything runs right on this page. Updated for 2026.

CAC Reader Troubleshooting FAQ

Why is my CAC reader not working?

The four most common causes, in order: the reader is plugged into an underpowered USB hub or dock instead of directly into the computer; the driver failed to install or went stale after an OS update; the Smart Card service (Windows) or pcscd daemon (Linux) is not running; or outdated middleware such as an old ActivClient version is intercepting the card. Work through those four and you will have found the problem on the vast majority of machines. The troubleshooter above gives you the exact steps for your operating system.

Why is my CAC reader not working on Windows 11?

Windows 11 reads modern PIV-capable CACs natively, so the usual culprits are an old ActivClient install that predates Windows 11, a stopped Smart Card service, or a driver that needs reinstalling from Device Manager. Restart the Smart Card service in services.msc, then run certutil -scinfo in Command Prompt: if it lists your reader and certificates, Windows is fine and the problem is browser configuration. If your CAC was issued after 2018 and your organization does not require ActivClient, uninstalling it often fixes Windows 11 problems outright.

Why won't my Mac read my CAC?

macOS has built-in smart card support, so no driver or middleware install is needed. The most common Mac failures are USB-C hubs that underpower the reader (plug it in directly), a browser that was opened before the card was inserted (quit and reopen it), and missing DoD root certificates in Keychain. Run sc_auth identities in Terminal with the card inserted: if your certificates are listed, the Mac reads the card fine and the fix is in the browser or Keychain trust settings. Note that the smart card pairing dialog is for logging into the Mac itself and is not required for CAC websites.

Do I still need ActivClient?

Usually not. Windows 10, Windows 11, and macOS all read modern PIV-capable CACs (issued roughly 2018 onward) with their built-in smart card support. ActivClient is only needed if your organization specifically requires it, and outdated copies are one of the most common causes of CAC failures, especially on Windows 11. If you do need it, get the current version from your unit IT office; it is licensed software and not a public download.

How do I install the DoD certificates?

Download the DoD PKI CA certificate bundle from DoD Cyber Exchange at public.cyber.mil/pki-pke. On Windows, run the InstallRoot tool or import the PKCS#7 bundle, then confirm DoD Root CA 3 through 6 appear in certmgr.msc under Trusted Root Certification Authorities. On a Mac, add the certificates to Keychain Access and set each DoD root to Always Trust. Firefox keeps its own trust store on every platform, so either import the roots under Certificates, Authorities, or set security.enterprise_roots.enabled to true. The roots are needed because DoD runs its own certificate authority that operating systems do not ship.

Why does my CAC work on one website but not another?

Because different DoD portals expect different certificates from your card, and your browser caches which certificate it sent to each site. Pick the certificate labeled Authentication (the one with your DoD ID number) rather than the Email certificate when prompted. On Windows, clear the cached choice via Internet Options, Content, Clear SSL State; on a Mac, delete the site's identity preference entry in Keychain Access. Then fully restart the browser and choose again. MilitaryCAC.com maintains per-site notes on which certificate each portal wants.

Related guides

Prefer a written walkthrough? Start with CAC card reader not detected on Windows 11, CAC card not working on Mac, CAC reader not working on Linux, or ActivClient vs Windows smart card.