DoD Root Certificates: Install on Windows, macOS, and Mobile

To install DoD root certificates on most computers, download the InstallRoot tool from the DoD Cyber Exchange and run it as an administrator; the installer adds every active Department of Defense root and intermediate certificate to your system’s trust store in one pass. Firefox, Linux, and mobile devices need extra steps because they don’t use the system store the Windows and macOS installers write to. Once the certificates are in place, .mil websites load normally instead of throwing “Your connection is not private” warnings.

What You Need Before You Start

The tool and files live on the DoD Cyber Exchange, run by the Defense Information Systems Agency.¹ The main installer is InstallRoot, currently version 5.6, and it bundles the active roots (DoD Root CA 3, CA 5, and CA 6) along with their intermediates.² There are separate 32-bit and 64-bit versions for Windows; check your system settings first if you’re unsure which you need.

You need administrator rights on the machine. Certificate installation writes to a system-level trust store, and without elevated permissions the tool either fails silently or throws a permissions error. On a work laptop managed by IT, ask for admin access or have the IT team run it.

If you’re on Linux, or you can’t use InstallRoot for some other reason, download the individual certificate files in PEM and DER formats from the same page before you begin.

Installing on Windows

Windows is the simplest case. Run the InstallRoot executable, click through the wizard, and the tool populates the Windows certificate store with every current root and intermediate. Chrome, Edge, and other Chromium-based browsers read from that same store, so one run covers all of them.

To verify what got installed, press Windows key + R, type mmc, and press Enter. In the Microsoft Management Console, go to File, then Add/Remove Snap-in, select Certificates, and choose Computer account. Under Trusted Root Certification Authorities you should see the DoD Root CA entries.³ Don’t use certmgr.msc for this check; it shows only the current user’s store, not the machine-wide store that services and system components rely on.

Installing on macOS

DISA publishes a macOS version of InstallRoot on the Cyber Exchange site.² If you go the manual route instead, open Keychain Access from Applications, then Utilities. Select the System keychain and drag each downloaded certificate file into the window. Double-click each imported certificate, expand the Trust section, and change “When using this certificate” to Always Trust. macOS will prompt for your admin password on each change. Safari and Chrome both read from the system keychain, so this covers both.

Installing on Linux

Linux is a manual process. Download the certificate bundle, extract the PKCS#7 file, and use OpenSSL to convert it into individual PEM files. Where the files go and how you refresh the trust store depends on your distribution:

Fedora, RHEL, and CentOS: place the certificate files in /etc/pki/ca-trust/source/anchors and run update-ca-trust.
Debian, Ubuntu, and Mint: place the files in /usr/local/share/ca-certificates with a .crt extension and run update-ca-certificates.

After the update command finishes, system tools like curl and wget will accept .mil sites. Browsers on Linux may still need their own configuration, especially Firefox.

Installing in Firefox

Firefox keeps its own certificate store on every operating system, so a successful InstallRoot run on Windows or a Keychain import on macOS does not carry over. You have to import the certificates into Firefox directly.

Open Settings, go to Privacy & Security, scroll to Certificates, and click View Certificates. On the Authorities tab, click Import and pick a DoD root certificate file (PEM or DER). Check the box to trust the certificate for identifying websites and confirm. Repeat for each root. It’s tedious because there’s no bundle installer here, only one file at a time. Restart Firefox and test on a .mil site.

Installing on iOS and Android

Mobile devices use configuration profiles rather than manual imports. On iOS, download the DoD root certificate configuration profile (often distributed by your organization as a .mobileconfig file). Open Settings, go to General, then VPN & Device Management, and the downloaded profile will be waiting. Tap Install, enter your passcode, and accept the prompts.⁴

Installing the profile is not the last step. Go to Settings, General, About, then Certificate Trust Settings, and toggle on each DoD Root CA individually.⁴ Skip this and Safari will keep rejecting DoD sites.

Android follows a similar pattern under Settings, Security, Encryption & Credentials, then Install a Certificate. The exact menu path varies by manufacturer.

Verifying the Install Worked

The quickest test is opening any .mil site. A lock icon in the address bar means the trust chain is in place. A security warning means the certificates either aren’t in the store your browser reads from, or they didn’t install at all.

For a deeper check on Windows, open the MMC Certificates snap-in for the Computer account and look under Trusted Root Certification Authorities for entries for DoD Root CA 3, CA 5, and CA 6, all listed as valid.³ On macOS, open Keychain Access, select System Roots or System, and search “DoD”; each certificate should show as trusted. In Firefox, look under Settings, Privacy & Security, View Certificates, Authorities and search “DoD.”

When Installation Fails

The single most common cause of failure on any platform is insufficient permissions. Before troubleshooting anything else, confirm you ran the installer as an administrator.

On Windows, InstallRoot writes two logs: the service log at C:\Program Files\DoD-PKE\InstallRoot\service\logs\InstallRoot.log and the GUI log at %LOCALAPPDATA%\DoD-PKE\InstallRoot\5.6\InstallRoot.log. Both are also accessible from the Help tab in the InstallRoot toolbar.⁵

InstallRoot also writes to the Windows Event Viewer under Applications and Services Logs, DoD-PKE InstallRoot. The event IDs worth knowing:

Event ID 200 confirms a successful update and reports how many certificates were installed.
Event ID 410 means the TAMP message signature is invalid or the signer certificate was revoked, usually a sign the InstallRoot package is corrupted or outdated.
Event ID 420 is a registry read failure or logging initialization failure.
Event ID 430 means the certificate store update failed, typically a permissions issue.

If you’re running InstallRoot from the command line, exit code 4 means you lack permission to modify the target store. Exit codes 10 and 11 mean the store couldn’t be opened, often because another application has locked it. Exit code 30 flags a running Firefox or Thunderbird process conflicting with NSS certificate imports; close all Mozilla applications and retry.⁵

Keeping Certificates Current

DoD roots expire. Under DoD policy, root CA certificates carry a maximum validity of 30 to 36 years, but the signing keys behind them are replaced more often, with key lifetimes capped at 20 years.⁶ Intermediates turn over faster, roughly every 6 to 10 years. When DoD issues a new root or retires an old one, sites signed by the new authority won’t be trusted until you update.

In practice, re-run InstallRoot every so often. DISA posts updated bundles on the Cyber Exchange, and a new run adds any new certificates while leaving existing valid ones alone. If a root CA key is ever compromised, the old root has to be removed manually from every device that trusted it and replaced through a fresh out-of-band distribution.⁶ That’s rare, but worth knowing if you’re maintaining more than one machine.

1
DoD Cyber Exchange. Cyber Exchange Home
2
DoD Cyber Exchange. Tools Configuration Files
3
Microsoft Learn. Trusted Root Certification Authorities Certificate Store
4
National Defense University. Apple Support: NDU DoD Root Certificate Configuration Profile
5
DoD Cyber Exchange. InstallRoot 5.6 User Guide
6
DoD Cyber Exchange. United States Department of Defense X.509 Certificate Policy