Resources: Installing DoD Root Certificates

Why/purpose: Installing the DoD Root Certificates will allow your web browsers to trust the identity of websites, such as ONR's, whose secure communications are authenticated by the Department of Defense.

Is this required? No, however, this will help you avoid Security Alert windows when you to go to secure communication websites for various DoD agencies, including the Office of Naval Research (ONR). Future access to DoD web sites may require certificates.

How to: Install the Root certificates: Microsoft IE | Netscape

For further assistance:Contact NSN's Helpdesk @ 202-433-9332 or via email itcc@ncis.navy.mil.

Downloading the Root Certificates Into Microsoft IE

Install Root is an executable program (*.exe) you can use to install your root certificates into Microsoft.

Choose one of the two following installation options:

1. Immediate installation: Click the Install Root link and select "OPEN" to install this program immediately to your Microsoft IE. You will see a command prompt open and show you the progress of the installation. Once the installation has finished, a message will say "Type the return key to terminate." Press ENTER onr your keyboard and the installation is complete.
   
   OR
   
   
2. Save file to local computer, then install: click the Install Root link and choose "Save This Program to Disk". Once you have downloaded the program to your computer, double-click the executable (installroot.exe) and you will see a command prompt open and show you the progress of the installation. Once the installation has finished, a message will say "Type the return key to terminate." Press ENTER onr your keyboard and the installation is complete.

Check the roots by opening Internet Explorer:

• Click Tools/Internet Options/Content/Certificates
• You should see the roots you just installed under the Intermediate Certification Authorities and Trusted Root Certification Authoritites tabs.

Downloading the Root Certificates Into Netscape

Netscape Communicator (Domestic (128-bit) version 4.73 or higher with PSM 1.2) is required to download your personal software certificate from a DoD PKI intermediate CA. PSM is a cryptographic plug-in module, and is not required for any other application.

To check the version of Netscape currently installed:

• On the Netscape menu bar, select Help.
  
• Select About communicator.
  
• The Netscape Communicator version will be displayed.
  
• Scroll down looking for the description "This version supports U.S. security with RSA Public Key Cryptography,...". This indicates that "Domestic (128-bit)" encryption is installed with your version of Netscape. If, instead you find the description "This version supports International security with RSA Public Key Cryptography,...", then the incorrect version of Netscape, with 64-bit encryption, has been loaded.

To determine which version of PSM, if any, has been installed:

• Select the security icon (the lock).
  
• Select the "Information" tab (default). If the "Information" tab does not exist, PSM has not been installed.
  
• Select "About Security". The first paragraph contains the PSM version number.
  

If PSM is not installed, download version 1.2 from the following web site:

Steps for installing the Root certificates into Netscape. In order to download the following Root certificate .cer files you must be using your Netscape browser.

1. Click the following one of the following downloading sites:
   
   

   https://ca-3.c3pki.chamb.disa.mil/reg1.html	Chambersburg
   https://ca-4.c3pki.den.disa.mil/reg1.html	Denver

   
   
2. In the DoD Class 3 PKI User Registration window, scroll down to the DOWNLOAD links.
3. Choose the first download link, "Download Class 3 Root CA Certificate," and a new window will open, called DOWNLOADING CERTIFICATES.
4. check all 3 boxes to "Trust this CA to identify web sites", "Trust this CA to identify email users", "and "Trust this CA to identify software developers".
   
5. Click OK.
6. Repeat steps 2-5 for the second link on the page, "Download Medium Assurance Root CA Certificate."
7. You will no longer need to proceed the certificate downloading sites.

In order to check the Root installation after following the above steps:

• Go to your Netscape EDIT menu to PREFERENCES
  
• Expand the PRIVACY & SECURITY option on the left side of the window
  
• Choose the CERTIFICATES option on the left side of the window
• Choose MANAGE CERTIFICATES on the right side of the window
• Choose the AUTHORITY tab
  
• Scroll to US Government DoD Class 3 Root CA and DoD PKI Med Root CA to ensure they are there
  
• Once verified, you may close out of the PREFERENCES windows.