Configure CAC & PIV

Last Updated: July 17, 2026

Common Access Cards (CAC) and Personal Identity Verification (PIV) cards control access to secure information systems. Government agencies, medical facilities, and others commonly use these cards to restrict access to sensitive information. PrinterLogic supports authenticating to the Admin Console with these cards.

How It Works

After configuring CAC / PIV, the Admin Console displays an additional login option. When the user selects the CAC / PIV Login button, the browser prompts the user to choose a certificate. With the smart card certificate selected, a prompt for the user's PIN appears. A successful Transport Layer Security (TLS) challenge / response handshake submits the certificate to PrinterLogic. PrinterLogic validates the certificate chain against the Certificate Authority (CA) bundle uploaded to the instance. It then performs an identity provider query to match the certificate against the user account.

Successful sign in occurs when the certificate matches a single Active Directory user, or if the certificate matches multiple Active Directory users, the username provided at login validates them.

Requirements

Review the following requirements:

Environment

• A smart card reader is attached to the workstation, and appropriate drivers are installed.
• A CAC / PIV smart card is available, and appropriate drivers are installed.
• All CAC / PIV root CAs are installed in the workstation's Trusted Root Certification Authorities store.
• All CAC / PIV issuing CAs are installed in the workstation's Intermediate Certification Authorities store.
• The user can authenticate to Windows by inserting the CAC / PIV card into the reader and entering their required credentials.

1. Configure DNS

If you configured PrinterLogic Allow Lists using a wildcard CNAME entry, continue to the next step. If you used individual CNAME entries for the services, add an entry for the CAC / PIV service.

pivcac.fqdn.of.va    CNAME    fqdn.of.va

2. Prepare CAC / PIV CA Bundle

Create a PEM certificate bundle containing all root and issuing CAs so PrinterLogic can validate the CAC / PIV certificate chain.

Option 1

If the agency has a PKCS7 bundle (.p7b) file containing all CA certificates:

1. Use the following command to convert the PKCS7 bundle to PEM format.

   Copy Code

   openssl pkcs7 -print_certs -in dod_certs.p7b -out pivcac.crt

2. Open the resulting pivcac.crt file in your preferred editor.

3. Remove the Subjects and Issuers from before each certificate.

   Only the concatenated list of certificates in PEM format, including the Begin headers and End footers should remain.

4. Save the file.

Option 2

If the agency does not have a PKCS7 bundle containing all the CA certificates:

1. Manually export each root and intermediate CA in X.509 base-64 encoded PEM format.
2. Create a single file containing the concatenated contents, and include the Begin headers and End footers for each.
3. Save the file.

3. Upload the CAC / PIV Bundle

In the PIV/CAC section, you'll see fields for Issuers, Subjects, and Filter. These fields are from the legacy setup and are not required when configuring CAC / PIV for PrinterLogic.

Troubleshooting Help