CAC reader for Mac: setup and fixes

Current macOS has smart card (CAC/PIV) support built in. Apple's own guide lists DoD Common Access Cards as supported, so in most cases you need a reader and the DoD certificates, not extra "CAC enabler" software.

1. Get a reader that fits your Mac

• Newer Macs have only USB-C ports. Use a USB-C CAC/PIV reader or a USB-A reader with an adapter.
• Some readers need a driver or firmware update from the reader maker's own website; check there if the Mac doesn't see it.

2. Check that macOS sees your card

1. Plug in the reader and insert your CAC, chip first and facing up.
2. Open System Information (hold Option, choose Apple menu > System Information) and look under Hardware > USB for the reader. Under Software > SmartCards you should see your card's details listed.
3. macOS may offer to "pair" the card with your Mac login. Apple says you can skip pairing and still use the card for websites.

3. Install and trust the DoD certificates

DoD root certificates aren't in Apple's built-in trust list. Get them from DoD Cyber Exchange (the PKI/PKE end-user page has the downloads and macOS instructions) and follow the certificate guide. If CAC sites still say the connection isn't trusted, the roots are usually installed but not marked trusted.

4. Test

1. Quit and reopen your browser, then open a CAC site such as webmail or MyPay. You should get a certificate picker and a PIN prompt.
2. Firefox uses its own certificate store and may need separate setup. Safari or Chrome is usually the easier path on a Mac.

Still not working?

• Older third-party CAC enabler software can conflict with the built-in support. If you installed one years ago, check the maker's removal steps.
• Try a different port, and avoid unpowered hubs.
• A locked or expired CAC can only be fixed at an ID card (RAPIDS) office.

Windows? See the general CAC reader guide.