Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

One of my employees recently got a CAC card and a USB reader.

The reader works fine, and I can see the certificates if I open IE9 and go to Options > Content > Certificates > Personal.

When I go to a DoD website (Internet Explorer JPAS) and click the CAC button, a dialog comes up with the different certs. I select DOD CA-25, type in my PIN and then the webpage errors out. (Internet Explorer doesn't give very good error reporting, but I think it was error 103.)

If I repeat these same steps from my home PC, everything works fine with the same reader and CAC.

What's going wrong at work?

Updates:

  • The error given by Chrome is "error 107"
  • I'm running Windows 7 64-bit
  • I get the same result with my Cherry st-1044u as my cheap cl-ud-200 63-in-1 card reader; both readers work perfectly on my old machine
share|improve this question

migrated from security.stackexchange.com Aug 21 '11 at 7:43

This question came from our site for Information security professionals.

6  
If you are a US DoD contractor review your DD254 block 11 regarding Operational Security. It may provide guidance on discussing operation issues with the general public. I believe posting information on this site would be considered general public, as it is universally accessible. If your DD254 does not provide guidance, I recommend asking for guidance from your FSO or appropriate representative for guidance on what operational issues may be discussed in an open forum. –  this.josh Aug 19 '11 at 7:14
    
There is no http status code 103: w3.org/Protocols/rfc2616/rfc2616-sec10.html Should be an error 403 if your authentication isn't working. Can you try from a different browser on the laptop? –  user56969 Aug 19 '11 at 15:09
    
@this.josh It's worse than that. Not only is it "general public", considering how heavily indexed these sites are in Google, but the posting itself is licensed CC BY-SA 3.0. –  Scott Pack Aug 20 '11 at 0:24
    
Update The error is "error 107 net::ERR SSL PROTOCOL ERROR SSL protocol error –  Crash893 Sep 1 '11 at 19:22
add comment

4 Answers

If your home browser doesn't ask for a cert, then you may have a different cert set installed. Compare the DoD certs installed on your home browser to those installed on the work machine. Also compare the certs available on the popup to the certs installed on your home machine.

You may be selecting DoD CA that is valid for the CAC but not valid for the website. (If the CAC is signed by multiple CAs)

Are you using the same destination website to test at work and at home?

If not you need to use the same URL to check the CAC operation.

If so check the site's IP address and certificate. The site may be mirrored on different networks, meaning that depending on where you connect from, the same URL may resolve to different systems, the different systems would likely have different IP addresses.

share|improve this answer
    
home browser does ask for a cert in the same manner as the laptop in question. –  Crash893 Aug 19 '11 at 14:02
    
@Crash - That doesn't sound correct. There is nothing special about IE9 or Win 7 when it comes to CAC cards. –  Ramhound Aug 19 '11 at 17:37
    
thats what I thought I don't remember doing anything special for my other machines other than updating the trusted root authority certs. –  Crash893 Aug 20 '11 at 5:34
    
@Crash893 Did you use the same version of InstallRoot on both machines? –  this.josh Aug 20 '11 at 5:49
add comment

Check the browser crypto settings (SSL, TLS) some site are particular on what they need. The company may have disable settings the site needs.

Also, if you never have been able to get there from work (from any machine), perhaps your public IP is on the DoD firewall black list.

share|improve this answer
    
it was done from the same location so IP address was the same. It is a default install of IE9 (i also tried default chrome and firefox) –  Crash893 Aug 19 '11 at 14:01
    
this is a base build of win7 64bit ie 9 (both 32 and 64) and chrome 13 do not work –  Crash893 Sep 1 '11 at 21:03
add comment

My answer is based on IE. If this is also happening on other browsers, please add the information to your post on the exact error you are encountering and the exact browser version (on both home and office).

Error 107 occurs when the Browser and website cannot agree on the SSL protocol to use. See below my answer point 1 which addresses this problem. Also, error reporting in IE can be improved by going to Control Panel -> Internet Options / Advanced tab / Browsing section, and unchecking "Show friendly HTTP error messages", press OK and restart IE.

I suggest reading this (very long) military article :
SOME PROBLEMS YOU MAY RECEIVE WHILE SETTING UP YOUR CAC READER & SOFTWARE

The article contains multiple solution to many problems. I selected some and remark that most Control Panel -> Internet Options pertains to IE but that some also pertain to other browsers (restart of the browser required after change).

  1. Internet Options / Advanced tab / Security section, make sure TLS 1.0 & SSL 3.0 are both checked, and SSL 2.0 NOT checked. If this does not help, try also checking SSL 2.0.
  2. Internet Options / Security tab / Trusted Sites, change the default level to low, add the domain to Trusted Sites. Also click Internet and change the default level to Medium.
  3. In Internet Options, clear the cache in General tab, Delete... button, place a check-mark on Temporary Internet Files and on Cookies and click the Delete button.
  4. under Internet Options / Advanced tab / Security section, try checking or unchecking "Allow Active Content from CD to run on My computer".
  5. Internet Options / Content / Certificates / Personal / Advanced, check the box that says "Client Authentication".
  6. Internet Options / Security tab, click on Internet and uncheck "Enable Protected Mode".

My addition : Disabling Internet Explorer Enhanced Security Configuration.

For Chrome, see the article I receive Error 107.

share|improve this answer
    
Not confirmed but best answer yet, With 3 hours to go you get the +50. I will report back later today if it works or not. –  Crash893 Sep 8 '11 at 17:23
add comment
up vote 1 down vote accepted

Okay so here is what happened. I never found out what the root cause of the issue was but on a whim I created a new user profile on the same machine. Logged into that profile and it workes like a charm.

not sure why but it fixed the issue.

Thanks for everyone that helped

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.