I found it very difficult, and could not get the CAC reader to work natively under Linux, but that may be b/c DoD websites require Chrome or Microsoft browsers. Once I got the VM installed, it worked consistently, and happily still have the reader but my CAC has been disabled, waiting on Kansas to get my records updated so I can go get a Retired ID.
I never had any problem getting it to work with Firefox. The hitch is always to make sure to install all the certs, including the latest, because the latest CAC may have a newer cert. My would loop through all the cert files in the directory and then them to the correct cert database. There's one for firefox and one for the linux OS .
This code snippet adds the cert files into the Linux OS certstore. Extract the cert files from the zip and then run this bash code within that directory.
Code:
#!/bin/bash
for CERTIFICATE_FILE in DOD*.cer
do
/usr/bin/certutil -A -d /etc/pki/nssdb -n $(basename $CERTIFICATE_FILE) -t CT,C,C -i $CERTIFICATE_FILE
done
This code snippet adds the cert files into the Firefox certstore. Same as above, run it in the directory that has the extracted .cer files.
Code:
#!/bin/bash
################################################################################
# Firefox-install-DoD-certificates
#
# Author: Kirk Lawson
# Date: 18 Feb 2021
# Description: This script will insert the DoD certificates into Firefox so that
# the user can use their CAC to connect to DoD web sites.
# Required: It's assumed that this is a Linux installation. The script
# searches for the file "cert8.db" to identify what directory
# mozilla puts its certificate database in. Note, new firefox
# versions are using "cert9.db" as well and may not have "cert8.db"
# Most will. This script should be run as the user. It expects
# to have all of the DoD certificates in the directory which it
# is being run from. The certs are currently being downloaded as
# on zip file: AllCerts.zip It can be downloaded from the DoD.
################################################################################
# Find the .mozilla directory which contains file "cert8.db" It is assued that
# this file exists. It might be replaced with "cert9.db"
certDB=$(find $HOME/.mozilla* -name "cert8.db");
certDir=$(dirname ${certDB});
# Echo out the cert to be installed so user can see progress and what its doing.
echo "Installing $certDir"
# Loop through all files in current directory matching "D*.cer" It is assumed
# that all DoD cert files will match "DoD*.cer" or "DOD*.cer" As looping
# through, use certutil (a mozilla utility) to insert the cert into mozilla /
# firefox database in above identified directory.
for CERTIFICATE_FILE in D*.cer
do
echo $CERTIFICATE_FILE
/usr/bin/certutil -A -n "$CERTIFICATE_FILE" -t "TCu,Cuw,Tuw" -i "$CERTIFICATE_FILE" -d sql:"${certDir}"
done
This should be all it takes to get the certs in the right place. Beyond that, it's just a matter of getting the SmartCard reader drivers and stuff. cackey or coolkey, libcrypto, pksc11, etc.
Peace favor your sword,
Kirk
