This zip file contains certificate trust chains for DoD Approved External PKIs.

This file provides a listing of all DoD and ECA CRLDPs. CRLDPs are represented by HTTP URLs that are asserted in the CRL Distribution Points certificate extension. CRLDPs are one of the mechanisms used by DoD relying party applications to validate certificates.

This document defines NIPRNet profiles for DoD Public Key Infrastructure (PKI) Certificates and Certificate Revocation Lists (CRLs).

This document provides Certification Authority (CA) certificate trust chain and assurance level information for all Department of Defense (DoD) approved Public Key Infrastructures (PKIs).

This zip file contains the DoD Web Content Filtering (WCF) PKI Certification Authority (CA) certificates in PKCS#7 certificate bundles containing either PEM-encoded or DER-encoded certificates. Instructions for verifying the integrity of all .p7b files using the signed SHA-256 hashes file (.sha256) are included in the README.

This zip file contains the External Certification Authority (ECA) PKI Certification Authority (CA) certificates in PKCS#7 certificate bundles containing either PEM-encoded or DER-encoded certificates. Separate PKCS#7 certificate bundles are also included for each root CA, for relying parties who may wish to only accept certificates issued with the key and signature hash combinations (e.g. RSA-2048/SHA-256) issued by a given root. Instructions for verifying the integrity of all .p7b files using the signed SHA-256 hashes file (.sha256) are included in the README.

Currently under development with no specific release date

This DoD CIO memo, dated 29 Oct 2024, provides guidance that Entrust NPE PKI certificates issued after 11 Nov 2024 should not be used to credential DoD public websites.

This slick sheet addresses questions regarding how and where commercial PKI certificates may be used within the DoD.

Cyber Awareness Challenge 2025

DCWF Orientation image

DCWF Game Show image

Cyber Excepted Service (CES) Train the Trainer Course image

Phishing Warfare trifold image

Social Networking and Your Online Identity Awareness

Cybersecurity Awareness Month (CSAM) - Mobile Device Usage: Do This/Not That

CES Orientation

Cyber Excepted Service (CES) Personnel System Workforce Orientation

Cyber Excepted Service (CES) Personnel System Leaders Orientation

Cybersecurity Awareness Month (CSAM) - Wearable and Mobile GPS-Enabled Devices Poster

Cybersecurity Awareness Month (CSAM) - Wearable and Mobile GPS-Enabled Devices Poster

Cyber Excepted Service (CES) HR Elements Lesson 6: Course Conclusion

Cyber Excepted Service (CES) HR Elements Lesson 5: Compensation Administration

Cyber Excepted Service (CES) HR Elements Lesson 4: Employment and Placement

Cyber Excepted Service (CES) HR Elements Lesson 3: Occupation Structure

Cyber Excepted Service (CES) HR Elements Lesson 2: CES Background

Cyber Excepted Service (CES) HR Elements Lesson 1: Introduction

CAE Criteria for CO Designation

CAE Criteria for CD Designation

This Certificate Policy (CP) addresses the requirements for the External Certification Authorities (ECAs). ECAs issue DoD approved PKI certificates to Subscribers who have a need to conduct business primarily with the government.

DoD Cyber Service Academy (DoD CSA) seal

This tool allows users to install DoD production PKI, Joint Interoperability Test Command (JITC) test PKI, and External Certification Authority (ECA) CA certificates into their Windows and Firefox certificate stores. InstallRoot 5.5 is packaged with a command line version as well as an InstallRoot service, which can check for updated Trust Anchor Management Protocol (TAMP) messages that contain the latest certificate information from DoD. The following operating systems are supported: Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, and 2022.

This tool allows users to install DoD production PKI, Joint Interoperability Test Command (JITC) test PKI, and External Certification Authority (ECA) CA certificates into their Windows and Firefox certificate stores. InstallRoot 5.5 is packaged with a command line version as well as an InstallRoot service, which can check for updated Trust Anchor Management Protocol (TAMP) messages that contain the latest certificate information from DoD. The following operating systems are supported: Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, and 2022.

This tool allows users to install DoD production PKI, Joint Interoperability Test Command (JITC) test PKI, and External Certification Authority (ECA) CA certificates into their Windows and Firefox certificate stores. InstallRoot 5.5 is packaged with a command line version as well as an InstallRoot service, which can check for updated Trust Anchor Management Protocol (TAMP) messages that contain the latest certificate information from DoD. The following operating systems are supported: Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, and 2022.

This tool allows users to install DoD production PKI, Joint Interoperability Test Command (JITC) test PKI, and External Certification Authority (ECA) CA certificates into their Windows and Firefox certificate stores. InstallRoot 5.5 is packaged with a command line version as well as an InstallRoot service, which can check for updated Trust Anchor Management Protocol (TAMP) messages that contain the latest certificate information from DoD. The following operating systems are supported: Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, and 2022.

This guide provides installation and usage instructions for the DoD PKE InstallRoot tool.

This file is used to allow formatting of the stig information with different tools

This FAQ discusses the issue of DoD certificates chaining improperly via cross-certificates to the Federal Common Policy Certification Authority (CA) and other partner roots cross-certified with the DoD and provides steps to resolve the issue.

This DoD CIO memo, dated 23 December 2022, provides guidance to the Department of Defense (DoD) components on actions they must undertake as DoD migrates to stronger algorithms for the DoD and National Security Systems (NSS) Public Key Infrastructures (PKI).

This memorandum, signed on November 8, 2021, updates and replaces DoD CIO Memorandum "Commercial Public Key Infrastructure Certificates on Public-Facing DoD Websites" dated November 6, 2020. It provides guidance on the use of commercial TLS and code signing PKI certificates on public-facing DoD websites and services.

This Certificate Policy (CP) defines policies for Certification Authorities (CAs) that issue and manage certificates under the Federal Common Policy CA on behalf of federal executive branch agencies.

This Certificate Policy (CP) defines certificate policies for use by the Federal Bridge Certification Authority (FBCA) to facilitate interoperability between the FBCA and other Entity PKI domains. The FBCA enables interoperability among Entity PKI domains in a peer-to-peer fashion. The FBCA issues certificates only to those CAs designated by the Entity operating that PKI (called Principal CAs). The DoD Interoperability Root Certificate Authority (IRCA) is one such Principle CA.

FIPS PUB 201-3 specifies Personal Identity Verification (PIV) requirements for Federal employees and contractors. This standard specifies a PIV system within which a common identity credential can be created and later used to verify a claimed identity. FIPS PUB 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors (Download Link)

FIPS 140-3 specifies requirements for designing and implementing cryptographic modules to be operated by or for federal departments and agencies.

The United States Department of Defense Certificate Policy (CP) is the unified policy under which a Certification Authority (CA) operated by a DoD component is established and operates. This document defines the creation and management of Version 3 X.509 public key certificates for use in applications requiring communication between networked computer-based systems.

CAE Criteria for R Designation

This Certificate Policy (CP) addresses the requirements for the External Certification Authorities (ECAs). ECAs issue DoD approved PKI certificates to Subscribers who have a need to conduct business primarily with the government.