When attempting to register, login, or authenticate a token with a CAC users may receive the following error:
Note: For Registration, Login, and Token Authentication, only the X509 Authentication Certificates from your Personal Certificate Store that have Key Usage of Digital Signature and Enhanced
Key Usage of Client Authentication should be used if present. If the Authentication Certificate is not present on the CAC, then the ID certificate must be used.
Key usage of 'Digital Signature' must be present on the ID Certificate.
This Error can be commonly caused by:
- Using an incompatible browser.
- Bad Browser Cache files.
- The Wrong certificate was selected.
- URL not in trusted sites list.
- The issue could also be at the Network level with a permissions issue.
It is recommended users engage with local IT support to assist them with the troubleshooting steps below as some users may not have adequate permission to perform the steps needed.
Additional Possible Solutions if the Common Solutions above did not resolve the error:
- Restart the browser and ensure a valid, current, authentication certificate is selected.
- Force a refresh of the page - on the error page press CTRL+F5. This can bypass the need to manually clear the browser cache for a single page by forcing the browser to re-download the temporary internet files and cookies for that page.
- If a VPN connection is in use attempt a login while the VPN is disconnected.
- If the errors persist it is recommended to engage with local IT support / local system administrators to assist with the troubleshooting steps above, as you may not have adequate permission to perform the steps needed. There may also be underlying network connection errors interrupting the connection.
How to identify the Authentication certificate when logging in with Chrome:
- Select a non-email certificate and click Certificate Information
- Go to Details and scroll down to Enhanced Key Usage, look for Smart Card Logon and Client Authentication
When a user accesses PIEE they may receive a prompt that the security certificate presented is
invalid, untrusted, not yet valid, or expired.
The exact message will depend on the browser used
Possible Causes:
- Has not installed the DoD certificate authorities
- The PC date and time is incorrect
Additional Possible Solutions if the Common Solutions above did not resolve the error:
- Complete the Machine Setup under New User
- Correct the system date and time
When attempting to register, login, or authenticate a token with a CAC users may receive the following error:
x
Error: The certificate validation trust failed ...
Possible Causes:
- The certificate is unreadable or DLA OCSP/valicert is unavailable
- The certificate used is invalid
- The certification path on the certificate contains invalid entries
- The certificate used is not on the trusted issuer list
Additional Possible Solutions if the Common Solutions above did not resolve the error:
-
Check Certificates in Internet Options
- From an open Internet Explorer window click Tools and select Internet Options or from the Control Panel
click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Identify the listed certificates
- Typical CAC users will have three listed certificates
- Under Issued To should be the users name followed by the dodID number
- Under Issued by you should typically see one or two Email certificates, and one
NON-Email certificate.
- The NON-Email [ALL] Certificate is the one used by PIEE
- If Invalid certificates are listed in the Republish Certificate(s)
- Select the NON-Email Certificate
- Click View
- Under the General Tab
- Check the Valid from dates to ensure the certificate is not
expired
- Under the Certification Path
- Check the certification path is valid
- The Certification Path is typically three levels deep
- The path should look like this:
- DoD Root CA 3
- DOD CA -XX [where XX = the CA issuing number]
- Lastname.first.I.xxxxxxxxxxxxxxxxx ....
- If the Certification Path is invalid:
- If the certification path is correct
- Verify the certificate is a valid X509 Certificate for Digital Signing and
Non-Repudiation. Non-repudiation is only required for signing documents
in the PIEE.
- Click the Details tab and scroll to Key Usage
- Verify that both Digital Signature and Non-Repudiation
are displayed
- If the certificate is missing Non-Repudiation the
certificate will need to be re-issued.
- Click OK on the Certificate dialog.
- Click Close on the Certificates dialog
- Click OK on the Internet Options dialog
-
Correct Certification Path
Correcting the certification path can resolve errors with certificates not being found, readable, or
verifiable.
This may require local administrative rights
- From an open Internet Explorer window click Tools and select Internet Options or from the Control Panel
click on Internet Options
- Click the Content Tab
- Click Certificates
- Under the Personal Tab, select the NON-Email Certificate
- Click View
- Under the Certification Path
- Check the certification path is valid
- The Certification Path typically three levels deep
- The path should look like this:
- DoD Root CA 3
- DOD CA -XX [where XX = the CA issuing number]
- Lastname.first.I.xxxxxxxxxxxxxxxxx ....
- If the Certification Path is invalid:
- Make note of each certificate listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click OK on the Certificate window
- On the Certificates window
- Click on the Intermediate Certification Authorities Tab
- Remove all the certificates that were listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click on the Trusted Root Certification Authorities Tab
- Remove all the certificates that were listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click Close on the Certificates dialog
- Click OK on Internet Options
-
Republish Certificate in Active Client
Removing and republishing user certificates can correct issues with certificates not being available,
readable, or verifiable.
Before proceeding notify the user that some of the following steps may require a local system administrator.
These steps cannot be completed without ActivClient and access to the ActivClient User Console. If that is
not available do not proceed.
- From the Control Panel click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Remove all listed certificates [NOTE: Email certificates can be left]
- Once all certificate are removed click close and OK on Internet Options
- Open ActivClient User Console
- Start > All Programs > ActivIdentity > ActivClient
- Select User Console
- Click Tools
- Select Advanced
- Click "Forget state for all cards" – or – Reset Optimization Cache (this removes
and republishes in one step)
- After confirmation, return to the Tools > Advanced menu
- Click "Make Certificates Available to Windows"
- Click Reset Optimization Cache
- Reboot the computer
- The CAC certificates should now be republished and available to use.
NOTE: the options to forget state and make certificates available are not in ActivClient version 8 - or -
Reset Optimization Cache (this removes and republishes in one step)
When attempting to register, login, or authenticate a token with a CAC users may receive the following error:
x
Error: A situation has occurred where your 'Session ID' has been assigned twice. In order to continue to
use the application it is required for you to CLOSE YOUR BROWSER. Once you have closed and reopened your
browser, you will be able to continue with the Procurement Integrated Enterprise Environment. If you are using the
IE 7 browser or a greater version of IE browser then close the whole browser, do not attempt to login on
multiple tabs.
Possible Causes:
- Closing your browser window without logging out of PIEE
- PIEE open on another tab.
- Browser unexpectedly crashed and auto-recovered.
Additional Possible Solutions if the Common Solutions above did not resolve the error:
-
Clear Browser Cache
Clearing the browser Temporary Internet File Cache can resolve many common browser and performance issues.
Some users may not have access to delete their own temporary internet files; in that case refer the user to
a system administrator.
Pressing CTRL+F5 can bypass the need to manually clear the browser cache for a single page by forcing the browser to
re-download the temporary internet files and cookies for that page.
Starting a new browser session can also refresh the browser cache, depending on the browser and user settings.
To manually clear the cache - this may apply to all browsers.
From the Control Panel click on Internet Options
-or-
From the Start menu search for "Internet Options"
- On the General Tab
- Under Browsing History click Delete
- Uncheck "Preserve Favorites Website Data" [if available]
- Check "Temporary Internet Files" [if unchecked]
- Check "Cookies" [if unchecked]
- Click Delete
To clear additional cache files from chrome - this is in addition to clearing through internet options, not in place of it.
Google Chrome:
- Click the three dots in the upper right corner below the red exit x
- Click "Settings"
- Under the Privacy heading, scroll down to "Clear browsing data"
- A window pops up with two sections:"Basic" or "Advanced"
- Use Advanced
- Select - All Time for the timeframe
- Check:
- Cookies and other site data
- Cached images and files
- Autofill form data
- Site Settings
- Hosted app data
- Once you've selected the items to clear, click "Clear data" and restart the browser
To clear additional cache files for Edge - this is in addition to clearing through internet options, not in place of it.
Microsoft Edge:
- To clear the Cache/Temporary Files & SSL State on Microsoft Edge: Click on the 3 dots top right corner(Alt+F)
- Click "Settings"
- Click Privacy, search, and services
- Scroll half way down to the Clear Browsing Data section
- Click Choose what to clear
- Make sure Time Range says All Time
- Make sure the following are selected:
- Make sure the following are selected:
- Cookies and other site data
- Cached images and files
- Site Permissions
- Auto-fill form data
- All data from the previous version of Microsoft Edge
- Media Foundation Data
- Click Clear Data
To clear cache files for Firefox.
Firefox:
- Click the three dots in the upper right corner below the red exit X
- Click "Options"
- Click "Privacy & Security" from the left menu
- Go down to the heading "Cookies and Site Data"
- Click "Clear Data"
- A window pops up with "Cookies and Site Data" and "Cached Web Content"
- Click "Clear" and "Clear Now in the next window prompt
If you have a suborn error, try fully clearing the browser cache—through the steps above, and for your specific browser below—start a new browser session, force a refresh (CTRL+F5), or reboot before moving on to additional troubleshooting.
-
Adjust IE Settings
Adjusting the Internet Explorer Browser settings can solve many common problems. Not all of the following
settings will be available to all users depending on local security policy.
- From an open Internet Explorer window click Tools and select Internet Options or from the Control Panel
click on Internet Options
- On the General Tab
- Clear the Browser Cache
- Under Browsing History click Delete
- Uncheck "Preserve Favorites Website Data" [if available]
- Check "Temporary Internet Files" [if unchecked]
- Check "Cookies" [if unchecked]
- Click Delete
- Click Settings under Browsing History
- Under Check for newer versions of stored pages
- Select "Every time I visit the webpage"
- Click OK
- Click Settings under Tabs
- Under When a Pop-up is encountered
- Select "Let Internet Explorer decide …"
- Click OK
- Click Security Tab
- Select Trusted Sites
- Click Sites
- If unlisted Add:
- https://*.eb.mil
- https://*.disa.mil
- Click Close
- Security level for Trusted sites should be Medium or lower
- If checked, uncheck Enable Protected Mode
- Click Privacy Tab
- If Pop-up Blocker is enabled [if disabled/unchecked continue to Content]
- Click Settings
- Add the following sites if they are not listed
- https://*.eb.mil
- https://*.disa.mil
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click on the Advanced Tab
- Under Browsing
- Check [if unchecked] "Show Friendly HTTP error messages"
- Under Security
- Uncheck "Use SSL2.0"
- Check "Use SSL 3.0"
- Check "Use TLS 1.0"
- Uncheck "Use TLS 1.1"
- Uncheck "Use TLS 1.2"
- Additional Steps:
- [If the user is a CAC user: Check Certificates in Internet Options ]
- Check IE Compatibility View
- If problems persist
- From the Advanced tab under Reset Internet Explorer settings
- Click Reset
- NOTE: This will reset any custom settings the user may require. This should only be done
if the end user understands this and the browser is otherwise unusable.
When attempting to login or register with a CAC users may receive errors related to the OCSP.
Most OCSP errors during CAC login are caused by network outages, OCSP server misconfiguration or downtime,
and/or Certificate Revocation Lists are not updated.
The Certificate Revocation Lists (CRL) are cached for the PIEE server certificate and applet code signing
certificate as this is handled on the Operating System / Browser level.
Things to Verify
- Has the certificate login ever worked with this certificate?
- Are other users receiving the same error?
- Is OCSP available? – check for system messages.
Additional Possible Solutions if the Common Solutions above did not resolve the error:
If CAC login has worked in the past, others are not receiving the same error, and there are no system messages indicating a known OCSP outage:
-
Republish Certificate in Active Client
Removing and republishing user certificates can correct issues with certificates not being available,
readable, or verifiable.
Before proceeding notify the user that some of the following steps may require a local system administrator.
These steps cannot be completed without ActivClient and access to the ActivClient User Console. If that is
not available do not proceed.
- From the Control Panel click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Remove all listed certificates [NOTE: Email certificates can be left]
- Once all certificate are removed click close and OK on Internet Options
- Open ActivClient User Console
- Start > All Programs > ActivIdentity > ActivClient
- Select User Console
- Click Tools
- Select Advanced
- Click "Forget state for all cards" – or – Reset Optimization Cache (this removes
and republishes in one step)
- After confirmation, return to the Tools > Advanced menu
- Click "Make Certificates Available to Windows"
- Click Reset Optimization Cache
- Reboot the computer
- The CAC certificates should now be republished and available to use.
NOTE: the options to forget state and make certificates available are not in ActivClient version 8 - or -
Reset Optimization Cache (this removes and republishes in one step)
-
Delete OCSP and/or CRL cache from your Windows system
To delete OCSP and/or CRL cache from your Windows system:
- Go to Start Menu > Run
- Type cmd and press Enter
- In the command promp, type the following command and press Enter to execute:
- certutil -urlcache * delete
- Reboot your computer
-
Obtain a copy of the certificate for testing or validation for the help desk
- From Internet Options go to the Content tab, and click Certificates.
- Select the certificate you wish to export and click Export.
- Click Next,
- Select No, do not export the private key
- Click Next,
- Select Base-64
- Click Next,
- click Browse to choose a location to save the file, Enter a filename, click Save
- Click Finish
- Change the file extension from .CER to .TXT to email the file.
- Navigate to the folder where the certificate was saved
- If the file extension is not visible click View at the top of the file explorer
- Check the box next to File Name Extensions
- Right click on the certificate, change the extension from .CER to .TXT
- The certificate file can now safely be emailed to the help desk.
When attempting to register, login, or authenticate a token with a CAC users may receive the following error:
x
Error: Next update value not found in the CRL list
Possible Causes:
- An expired certificate was selected
- Local certificate store is corrupt
- Certificate issuer Certificate Revocation List has expired in OCSP
Additional Possible Solutions if the Common Solutions above did not resolve the error:
-
If the error is recent clear cache and try again after an hour, if more than 2 hours has passed continue troubleshooting.
-
Clear Browser Cache
Clearing the browser Temporary Internet File Cache can resolve many common browser and performance issues.
Some users may not have access to delete their own temporary internet files; in that case refer the user to
a system administrator.
Pressing CTRL+F5 can bypass the need to manually clear the browser cache for a single page by forcing the browser to
re-download the temporary internet files and cookies for that page.
Starting a new browser session can also refresh the browser cache, depending on the browser and user settings.
To manually clear the cache - this may apply to all browsers.
From the Control Panel click on Internet Options
-or-
From the Start menu search for "Internet Options"
- On the General Tab
- Under Browsing History click Delete
- Uncheck "Preserve Favorites Website Data" [if available]
- Check "Temporary Internet Files" [if unchecked]
- Check "Cookies" [if unchecked]
- Click Delete
To clear additional cache files from chrome - this is in addition to clearing through internet options, not in place of it.
Google Chrome:
- Click the three dots in the upper right corner below the red exit x
- Click "Settings"
- Under the Privacy heading, scroll down to "Clear browsing data"
- A window pops up with two sections:"Basic" or "Advanced"
- Use Advanced
- Select - All Time for the timeframe
- Check:
- Cookies and other site data
- Cached images and files
- Autofill form data
- Site Settings
- Hosted app data
- Once you've selected the items to clear, click "Clear data" and restart the browser
To clear additional cache files for Edge - this is in addition to clearing through internet options, not in place of it.
Microsoft Edge:
- To clear the Cache/Temporary Files & SSL State on Microsoft Edge: Click on the 3 dots top right corner(Alt+F)
- Click "Settings"
- Click Privacy, search, and services
- Scroll half way down to the Clear Browsing Data section
- Click Choose what to clear
- Make sure Time Range says All Time
- Make sure the following are selected:
- Make sure the following are selected:
- Cookies and other site data
- Cached images and files
- Site Permissions
- Auto-fill form data
- All data from the previous version of Microsoft Edge
- Media Foundation Data
- Click Clear Data
To clear cache files for Firefox.
Firefox:
- Click the three dots in the upper right corner below the red exit X
- Click "Options"
- Click "Privacy & Security" from the left menu
- Go down to the heading "Cookies and Site Data"
- Click "Clear Data"
- A window pops up with "Cookies and Site Data" and "Cached Web Content"
- Click "Clear" and "Clear Now in the next window prompt
If you have a suborn error, try fully clearing the browser cache—through the steps above, and for your specific browser below—start a new browser session, force a refresh (CTRL+F5), or reboot before moving on to additional troubleshooting.
-
Check Certificates in Internet Options
- From an open Internet Explorer window click Tools and select Internet Options or from the Control Panel
click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Identify the listed certificates
- Typical CAC users will have three listed certificates
- Under Issued To should be the users name followed by the dodID number
- Under Issued by you should typically see one or two Email certificates, and one
NON-Email certificate.
- The NON-Email [ALL] Certificate is the one used by PIEE
- If Invalid certificates are listed in the Republish Certificate(s)
- Select the NON-Email Certificate
- Click View
- Under the General Tab
- Check the Valid from dates to ensure the certificate is not
expired
- Under the Certification Path
- Check the certification path is valid
- The Certification Path is typically three levels deep
- The path should look like this:
- DoD Root CA 3
- DOD CA -XX [where XX = the CA issuing number]
- Lastname.first.I.xxxxxxxxxxxxxxxxx ....
- If the Certification Path is invalid:
- If the certification path is correct
- Verify the certificate is a valid X509 Certificate for Digital Signing and
Non-Repudiation. Non-repudiation is only required for signing documents
in the PIEE.
- Click the Details tab and scroll to Key Usage
- Verify that both Digital Signature and Non-Repudiation
are displayed
- If the certificate is missing Non-Repudiation the
certificate will need to be re-issued.
- Click OK on the Certificate dialog.
- Click Close on the Certificates dialog
- Click OK on the Internet Options dialog
-
Correct Certification Path
Correcting the certification path can resolve errors with certificates not being found, readable, or
verifiable.
This may require local administrative rights
- From an open Internet Explorer window click Tools and select Internet Options or from the Control Panel
click on Internet Options
- Click the Content Tab
- Click Certificates
- Under the Personal Tab, select the NON-Email Certificate
- Click View
- Under the Certification Path
- Check the certification path is valid
- The Certification Path typically three levels deep
- The path should look like this:
- DoD Root CA 3
- DOD CA -XX [where XX = the CA issuing number]
- Lastname.first.I.xxxxxxxxxxxxxxxxx ....
- If the Certification Path is invalid:
- Make note of each certificate listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click OK on the Certificate window
- On the Certificates window
- Click on the Intermediate Certification Authorities Tab
- Remove all the certificates that were listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click on the Trusted Root Certification Authorities Tab
- Remove all the certificates that were listed above DoD Root CA-3
- E.G. DoD Interoperability
- Click Close on the Certificates dialog
- Click OK on Internet Options
-
Republish Certificate in Active Client
Removing and republishing user certificates can correct issues with certificates not being available,
readable, or verifiable.
Before proceeding notify the user that some of the following steps may require a local system administrator.
These steps cannot be completed without ActivClient and access to the ActivClient User Console. If that is
not available do not proceed.
- From the Control Panel click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Remove all listed certificates [NOTE: Email certificates can be left]
- Once all certificate are removed click close and OK on Internet Options
- Open ActivClient User Console
- Start > All Programs > ActivIdentity > ActivClient
- Select User Console
- Click Tools
- Select Advanced
- Click "Forget state for all cards" – or – Reset Optimization Cache (this removes
and republishes in one step)
- After confirmation, return to the Tools > Advanced menu
- Click "Make Certificates Available to Windows"
- Click Reset Optimization Cache
- Reboot the computer
- The CAC certificates should now be republished and available to use.
NOTE: the options to forget state and make certificates available are not in ActivClient version 8 - or -
Reset Optimization Cache (this removes and republishes in one step)
-
Delete OCSP and/or CRL cache from your Windows system
To delete OCSP and/or CRL cache from your Windows system:
- Go to Start Menu > Run
- Type cmd and press Enter
- In the command promp, type the following command and press Enter to execute:
- certutil -urlcache * delete
- Reboot your computer
When attempting to register, login, or authenticate a token with a CAC users may receive the following error:
x
Error: Error Signature on random number challenge invalid.
Things to verify:
-
This is an issue with the way the browser is accessing the Certificates
- Call gscBsiGetChallenge() to retrieve a random challenge from the smart card.
- The random challenge is retained by the smart card for use in the subsequent
verification step of the External Authentication protocol.
- The client
application calculates a cryptogram by encrypting the random challenge using a
symmetric External Authentication key.
- The client application may need to
examine the keyIDOrReference member of the appropriate ACR returned in GCacr
or CRYPTOacr to determine which External Authentication key it should use to
encrypt the random challenge
Additional Possible Solutions if the Common Solutions above did not resolve the error:
-
Republish Certificate in Active Client
Removing and republishing user certificates can correct issues with certificates not being available,
readable, or verifiable.
Before proceeding notify the user that some of the following steps may require a local system administrator.
These steps cannot be completed without ActivClient and access to the ActivClient User Console. If that is
not available do not proceed.
- From the Control Panel click on Internet Options
- Click the Content Tab
- Under Certificates
- Click Clear SSL State
- Click OK on the confirmation that the cache was cleared
- Click Certificates
- Under the Personal Tab
- Remove all listed certificates [NOTE: Email certificates can be left]
- Once all certificate are removed click close and OK on Internet Options
- Open ActivClient User Console
- Start > All Programs > ActivIdentity > ActivClient
- Select User Console
- Click Tools
- Select Advanced
- Click "Forget state for all cards" – or – Reset Optimization Cache (this removes
and republishes in one step)
- After confirmation, return to the Tools > Advanced menu
- Click "Make Certificates Available to Windows"
- Click Reset Optimization Cache
- Reboot the computer
- The CAC certificates should now be republished and available to use.
NOTE: the options to forget state and make certificates available are not in ActivClient version 8 - or -
Reset Optimization Cache (this removes and republishes in one step)
- Local system administrators/support to reinstall/Update ActivClient.
An error that there are multiple accounts associated with a certificate:
x
Error: multiple accounts associated with a certificate:
Possible Causes:
- There may be a duplicate account associated with the certificate.
- The impacted user may have been issued a new certificate that is not completely identical to the certificate associated with the account.
Additional Possible Solutions if the Common Solutions above did not resolve the error:
-
Contact your GAM or the PIEE Service Desk
-
If there are not multiple accounts found
- The affected user is likely receiving this error due to recently received a new certificate. In this case the GAM will want to reset the certificate so the user can re-associate their current certificates with the account.
-
If there are multiple accounts found
- The certificate will need to be reset/removed from one of the registered account, and that unused account archived by the Government Administrator, or the PIEE Service Desk