Reviewed July 17, 2026. This guide uses the official DoD Cyber Exchange rather than third-party certificate downloads.
On Windows, the DoD provides InstallRoot to install and maintain DoD certificate authorities in Windows and supported application trust stores. The current official document library lists InstallRoot 5.6 packages for Windows.
Before you begin
- Use only an official cyber.mil or dod.cyber.mil download.
- Confirm whether Windows is 64-bit or 32-bit.
- If you do not have administrator rights, choose the official Non-Administrator installer.
- Keep Windows and your browser fully updated.
Install the current DoD trust package
- Open the DoD Cyber Exchange PKI/PKE document library.
- Find the current InstallRoot Windows installer that matches your system and permissions.
- Download it from the official DoD site and follow the installer prompts.
- Open InstallRoot and install the DoD production certificates into the trust stores required by your browser and applications.
- Restart the browser or application before testing CAC access.
The DoD publishes updated certificate authorities periodically. Recheck the official library instead of relying on an old copied installer link.
If CAC access still fails
- Confirm that the card reader appears in Windows Device Manager.
- Try another USB port and confirm the reader firmware or driver requirements.
- Verify that the browser or application supports the certificate store you updated.
- Contact the help desk responsible for the specific DoD service you are accessing.
For detailed steps, use the official InstallRoot user guide.
Security note: Installing a root certificate changes which certificate authorities your computer trusts. Do not import certificate files from unverified downloads, email attachments, or file-sharing services.