Updating DoD Certificates Using InstallRoot

Applies to: CRL staff accessing DoD (.mil) websites or CAC-enabled resources  |  Category: Certificates & Access  |  Est. time: 10 minutes

This guide walks you through updating Department of Defense (DoD) certificates using InstallRoot, the tool the Defense Information Systems Agency (DISA) provides to manage DoD PKI certificates on Windows. Keeping these certificates current is what lets your computer trust DoD (.mil) websites and CAC-enabled resources without certificate errors.

Source of truth: InstallRoot and the DoD certificate bundles are published on the DoD Cyber Exchange — PKI/PKE Tools & Configuration Files page. Always download from there (or a link the IT Team provides) — never from a third-party site.

1. Download and install InstallRoot

• Go to the DoD Cyber Exchange PKI/PKE Tools & Configuration Files page and download the latest InstallRoot (currently version 5.6) for NIPR. Choose the Administrator installer if you have admin rights, or the Non-Administrator installer if you don’t.
• Run the downloaded installer.
• Follow the on-screen prompts. Installing the Administrator version requires admin rights — if you don’t have them, use the Non-Administrator installer or request an elevation.

2. Launch InstallRoot

• Open InstallRoot from the Start menu or its desktop shortcut.
• If prompted to allow the app to make changes, click Yes (or enter admin credentials) to continue.

3. Select certificate stores

InstallRoot shows tabs for the different certificate stores it can manage:

• Microsoft Store — for DoD certificates used by Windows and Edge/Chrome.
• Firefox Store — for the Firefox browser.
• Java Store — for applications that rely on Java. Java is not commonly installed on CRL endpoints, so this applies on a case-by-case basis — only if a specific application you use requires it.

Select the store(s) you need. For most CRL users the Microsoft Store is sufficient; add Firefox or Java only if you use them.

4. Install / update the certificates

• Click Install Certificates. InstallRoot installs the current DoD root and intermediate certificates into the selected store(s).
• Updating overwrites outdated certificates and adds any new ones, so this both installs and refreshes in one step.

5. Verify the installation

• On the Microsoft Store tab, scroll the list of installed certificates.
• Confirm the current DoD roots are present and valid — today those are DoD Root CA 3, DoD Root CA 5, and DoD Root CA 6. (Older roots such as CA 2 and CA 4 have been retired.)

Don’t worry about tracking individual CA numbers — InstallRoot always installs the full current set. The names above are just what you should expect to see.

6. Close InstallRoot

Once you’ve verified the certificates, close InstallRoot.

7. Test (optional)

• Visit a DoD site such as https://www.dmdc.osd.mil.
• Confirm the page loads with no certificate-trust errors.

If you still experience problems, let the CRL IT Team know by submitting a request for assistance: Submit a Request for Assistance.

---

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.