3 ms·

Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.

by zrail 11y ago

geofft 11y ago
What does it mean to insert it "on" a site? I have two dozen tabs open; how should Chrome know that my authentication information should go to the government but not to Hacker News? It seems to me like you necessarily want a custom solution and custom software here; I'm not understanding how the removal of client-cert support from public builds of Chrome or Firefox would be a problem. (I've never used a CAC, so this might be a dumb question.)
- zrail 11y ago
  When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD-provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized. When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal. The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re-enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.
pharaohgeek 11y ago
Actually, the CAC is being used for desktop login into Active Directory in a lot (all?) cases, so it's reasonable to assume that the CAC is already in the reader when you fire up the web browser.

Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.

by zrail 11y ago

Typically you'd only insert your CAC on sites already trusted by your machine, and your machine only has those DoD certs if it's been provisioned by DoD.

geofft 11y ago

What does it mean to insert it "on" a site? I have two dozen tabs open; how should Chrome know that my authentication information should go to the government but not to Hacker News? It seems to me like you necessarily want a custom solution and custom software here; I'm not understanding how the removal of client-cert support from public builds of Chrome or Firefox would be a problem. (I've never used a CAC, so this might be a dumb question.)

zrail 11y ago
When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD-provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized. When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal. The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re-enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.

pharaohgeek 11y ago

Actually, the CAC is being used for desktop login into Active Directory in a lot (all?) cases, so it's reasonable to assume that the CAC is already in the reader when you fire up the web browser.