STEP 3: INSTALL the Department of Defense (DoD) CERTIFICATES
InstallRoot automates the install of the DoD certificates onto your Windows computer
If you want to access DoD websites from your Windows computer, you need these certificates on your computer. You may need to reinstall the certificates if the CAC enabled web site won't load, the website you are visiting is prompting you with the message there is a problem with the website's Security Certificate / site is not trusted, you have received a new CAC, or your DoD website worked up until recently and doesn't now.
InstallRoot is created by DISA, if you have any problems with this file, please contact them.
NOTE: If you want to install the certificates manually, follow these instructions.
Download InstallRoot 5.1 from:
MilitaryCAC (.msi version) (26.40MB),
MilitaryCAC (.zip version) (25.40MB),
AKO (.msi version) (26.40MB), or
DISA (.msi version) (26.40MB)
(It is the same file [except for .zip version] from 3 different web locations, in the event one of the links don't work)
Select Next >
Leave the default installation location, then select Next >
Select Next >
Wait for it
Select Run InstallRoot
Double click shortcut on your desktop (if you selected Close) Your icon may show 4.1, 5.0, or 5.0.1
Click Install Certificates
If you have Firefox installed, you may see 2 or 3 tabs
You may receive an error message stating it Failed to perform an online update.
To fix this, you'll need to add an entry to your registry by running this file, or adding it manually by: Typing regedit.msc in the search box, navigate to: HKEY_LOCAL_MACHINE \ SOFTWARE \ WOW6432Node \ Microsoft \ .NETFramework \ v4.0.30319 then add a New DWORD (32-bit) Value of: SchUseStrongCrypto, and making the value 1
This registry fix idea was submitted by Cecil Achord of Seaward Marine Services in Norfolk, VA. Thank you for this fix.
Select Yes, (this screen may show 2 - 3 times) as it is installing the DoD Root CA 2, 3, & 4 certificates
Select OK (your number of Adds will vary)
How to verify you have the certificates installed
Open Internet Explorer, Select Tools (Gear), Internet Options
Select Content (tab), Certificates (button)
Intermediate Certification Authorities (tab) scroll down the Issued To (column) to the letters DOD to verify you have:
DOD CA-31 and DOD CA-32
DOD EMAIL CA-31 through DOD EMAIL CA-34
DOD EMAIL CA-39 through DOD EMAIL CA-44
DOD EMAIL CA-49 through DOD EMAIL CA-52
DOD ID CA-33 through DOD ID CA-34
DOD ID CA-39 through DOD ID CA-44
DOD ID CA-49 through DOD ID CA-52
DOD ID SW CA-35 through DOD ID SW CA-38
DOD ID SW CA-45 through DOD ID SW CA-48
DOD SW CA-53 through DOD SW CA-58
also verify the Root certificates installed (as sometimes the Antivirus program doesn't allow these to be installed)
Open the Trusted Root Certification Authorities (tab) verify you have:
DoD Root CA 2 through DoD Root CA 5
PROCEED TO STEP 4 - INSTALL ACTIVCLIENT
The Cross Cert Remover tool is "supposed" to be an automated way of removing some certificates that cause access problems. From what I've experienced, you still need to follow my guide [slides 15&16] and manually remove certificates the Cross Cert Removal Tools fails to remove. Feel free to use if you want to waste your time.
You can install both the InstallRoot and the Cross Cert Removal tool in one single file which was created by NETCOM (Army Network Enterprise Technology COMmand)
This file is created for Home Users ONLY, you can download it from:
A certificate is a digital document providing the identity of a Web site or individuals. DoD Web sites use a certificate to identify themselves to their users and to enable secure connections. If you are receiving a warning that a site is untrusted / insecure, you will need to install the "DoD Certificates." In order to access sites enabled with a DoD PKI certificate without being prompted to accept the DoD Certificate chain at each log on [like Firefox and Safari do], people using Internet Explorer and Chrome should install the certificates. These are separate from the personal certificates that are on your CAC, but they are related.
How can you (or your web server) trust the identity of someone over the network? An infrastructure of trusted third parties has been put in place to distribute trust between end-users. This infrastructure verifies that we are who we say we are. If we trust the DoD PKI infrastructure, then the infrastructure can vouch for us to trust others that have certificates issued from the DoD PKI.
Click to see full size image
The DoD PKI Infrastructure is comprised of two Root Certification Authorities and a number of Intermediate Authorities. If all of the DoD root certificates are not installed on your computer, various applications will not be able to trust all DoD PKI certificates.
More information about this image can be found here: http://iase.disa.mil/pki-pke/interoperability/Pages/index.aspx
If you have questions or suggestions for this site, contact Michael J. Danberry
Are you interested in subscribing to the CACNews email list?
Last Update or Review: Wednesday, 15 November 2017 21:42 hrs
The following domain
names all resolve to the same website: ChiefsCACSite.com,
CommonAccessCard.us, CommonAccessCard.info, & ChiefGeek.us
The following domain names all resolve to the same website: ChiefsCACSite.com, CommonAccessCard.us, CommonAccessCard.info, & ChiefGeek.us