When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page w

When you go to a DoD CAC-enabled site, typically you'll first see a click-wrapper page saying "This is a DoD site, blah blah perjury, prison, blah". This page will present a certificate signed with a DoD CA that only DoD-provisioned machines have. The DoD has a whole suite of CAs for different departments and security levels, which keeps things compartmentalized. When you click through, you'll be directed to a page that, via standard SSL, requests a client certificate which triggers the browser prompt. At this point, you insert your CAC and select the certificate it contains. After you enter your PIN to unlock the certificate, your browser sends your client cert back and the site verifies that your CAC was issued by the CAC CA and that it hasn't been revoked, then HTTPS proceeds as normal. The trick is that CAC certificates can't be used blindly, since you have to enter your PIN every time it gets used in a new session. Public sites can't just request a client cert without triggering the prompt and making you re-enter your PIN, and typically the CAC isn't inserted when you're not using DoD sites or on the DoD VPN.