Install DoD certificates (InstallRoot) and fix PKI errors

Fix 'not trusted', 'connection not private' and missing-cert errors on CAC sites.

Most "your connection is not private" or certificate-untrusted errors on .mil sites mean your computer doesn't have the DoD root and intermediate certificates. The DoD's free InstallRoot tool installs them on Windows.

Windows: InstallRoot

1. Go to the DoD Cyber Exchange PKI/PKE Tools page (link below).
2. Download InstallRoot 5.6 NIPR: the 64-bit Windows Installer for most PCs, or the Non-Administrator installer if you don't have admin rights.
3. Run the installer, then open InstallRoot.
4. Install the DoD certificates (the default DoD group) and close the tool.
5. Fully close and reopen your browser, then retry the site.

Mac and other systems

1. From the Cyber Exchange Configuration Files list, download PKI CA Certificate Bundles: PKCS#7 for DoD PKI Only.
2. Unzip it and import the certificates into your system's certificate store (Keychain Access on macOS), then set the DoD Root CAs to trusted, following the readme included in the bundle.

Common errors

• Still untrusted after install: restart the browser; Firefox keeps its own certificate store, so import the certs there or use Edge/Chrome.
• Wrong certificate picked: when a site asks, choose the authentication cert (not the "Email"/signature one) unless told otherwise.
• Only download from public.cyber.mil. Third-party copies aren't trustworthy.