CAC not working; Chrome gives "error 107"

Question

One of my employees recently got a CAC card and a USB reader.

The reader works fine, and I can see the certificates if I open IE9 and go to Options > Content > Certificates > Personal.

When I go to a DoD website (Internet Explorer JPAS) and click the CAC button, a dialog comes up with the different certs. I select DOD CA-25, type in my PIN and then the webpage errors out. (Internet Explorer doesn't give very good error reporting, but I think it was error 103.)

If I repeat these same steps from my home PC, everything works fine with the same reader and CAC.

What's going wrong at work?

Updates:

• The error given by Chrome is "error 107"
• I'm running Windows 7 64-bit
• I get the same result with my Cherry st-1044u as my cheap cl-ud-200 63-in-1 card reader; both readers work perfectly on my old machine

Answer 1

If your home browser doesn't ask for a cert, then you may have a different cert set installed. Compare the DoD certs installed on your home browser to those installed on the work machine. Also compare the certs available on the popup to the certs installed on your home machine.

You may be selecting DoD CA that is valid for the CAC but not valid for the website. (If the CAC is signed by multiple CAs)

Are you using the same destination website to test at work and at home?

If not you need to use the same URL to check the CAC operation.

If so check the site's IP address and certificate. The site may be mirrored on different networks, meaning that depending on where you connect from, the same URL may resolve to different systems, the different systems would likely have different IP addresses.

Answer 2

Check the browser crypto settings (SSL, TLS) some site are particular on what they need. The company may have disable settings the site needs.

Also, if you never have been able to get there from work (from any machine), perhaps your public IP is on the DoD firewall black list.

Answer 3

_{My answer is based on IE. If this is also happening on other browsers, please add the information to your post on the exact error you are encountering and the exact browser version (on both home and office).}

Error 107 occurs when the Browser and website cannot agree on the SSL protocol to use. See below my answer point 1 which addresses this problem. Also, error reporting in IE can be improved by going to Control Panel -> Internet Options / Advanced tab / Browsing section, and unchecking "Show friendly HTTP error messages", press OK and restart IE.

I suggest reading this (very long) military article :
SOME PROBLEMS YOU MAY RECEIVE WHILE SETTING UP YOUR CAC READER & SOFTWARE

The article contains multiple solution to many problems. I selected some and remark that most Control Panel -> Internet Options pertains to IE but that some also pertain to other browsers (restart of the browser required after change).

1. Internet Options / Advanced tab / Security section, make sure TLS 1.0 & SSL 3.0 are both checked, and SSL 2.0 NOT checked. If this does not help, try also checking SSL 2.0.
2. Internet Options / Security tab / Trusted Sites, change the default level to low, add the domain to Trusted Sites. Also click Internet and change the default level to Medium.
3. In Internet Options, clear the cache in General tab, Delete... button, place a check-mark on Temporary Internet Files and on Cookies and click the Delete button.
4. under Internet Options / Advanced tab / Security section, try checking or unchecking "Allow Active Content from CD to run on My computer".
5. Internet Options / Content / Certificates / Personal / Advanced, check the box that says "Client Authentication".
6. Internet Options / Security tab, click on Internet and uncheck "Enable Protected Mode".

My addition : Disabling Internet Explorer Enhanced Security Configuration.

For Chrome, see the article I receive Error 107.

Answer 4

Okay so here is what happened. I never found out what the root cause of the issue was but on a whim I created a new user profile on the same machine. Logged into that profile and it workes like a charm.

not sure why but it fixed the issue.

Thanks for everyone that helped

Answer 5

Though this answer comes 5 years after the question was asked, I ran into an issue with invalid certificate chains.

Overview

If you've installed the other DoD certificates properly (and I will defer to the unclassified documentation on militarycac.com and DoD PKE about InstallRoot ~5.0.0), you may, like me, have conflicting certificate chains.

In the Internet Options configuration tool (or certmgr.msc if that's your fancy), you need to remove several conflicting certs. You can refer to MilitaryCAC's writeup, his other writeup (see the pages on "bad certs") or use DoD PKE's Cross-Certificate remover (available on the same page as InstallRoot, with some documentation) to remove the "bad certs", though MilitaryCAC has found the official tool wanting:

Feel free to use if you want to waste your time.

Remedial Steps

1. Ensure DoD certificates are installed (using InstallRoot 5.0.0 or greater; alternative: non-HTTPS official site; both packages are improperly signed, but should run anyway)
2. Open the certificates page (Internet Explorer → Internet Options → Content → Certificates or certmgr.msc if you know how to use it).
3. Remove the invalid Intermediate Certificate Authorities (NOT Trusted Root Certificates)
   • DoD Interoperability Root CA 1 (Exp 11/15/2019)
   • DoD Root CA 2 (Exp 9/6/2019; why is a root CA in intermediate certs?)
   • SHA-1 Federal Root CA G2 (Exp 12/31/2019)
   • DoD Interoperability Root *something* (Exp 8/15/2019)
   • DoD Root CA 3 (Exp 2/17/2019)
   • Federal Bridge CA 2016 (Exp 11/8/2019)
4. Should work. Maybe after a restart.