Home → CRL IT - How To Guide → Web Browser Tips and Troubleshooting → Updating DoD Certificates Using InstallRoot

9.4. Updating DoD Certificates Using InstallRoot

Last updated: Fri Oct 2024 11:14 AM (EDT)

How-to Guide: Updating DoD Certificates Using InstallRoot

This guide will walk you through the process of updating Department of Defense (DoD) certificates using the InstallRoot application. InstallRoot is a tool the Defense Information Systems Agency (DISA) developed to manage DoD PKI certificates on Windows systems.

Step-by-Step Instructions

1. Download and Install InstallRoot

• Visit the DISA Cyber.mil site: https://public.cyber.mil/installroot_5-4/ and download the latest version of InstallRoot (typically available as an EXE file).
• Run the downloaded file to start the installation process.
• Follow the on-screen prompts to install InstallRoot on your system. You may need administrative privileges to complete this installation.

2. Launch InstallRoot

• Once installed, launch the InstallRoot application by searching for it in your Start Menu or by double-clicking the desktop shortcut.
• You might be prompted for admin credentials or asked to allow the app to make changes to your device. Click Yes or enter the admin password to proceed.

3. Select Certificate Stores

• When InstallRoot opens, you will see several tabs representing different certificate stores, such as:
  • Microsoft Store: For DoD certificates used by Windows applications.
  • Firefox Store: For DoD certificates used by Firefox browsers.
  • Java Store: For applications relying on Java.
• Select the stores where you need to update or install certificates. For most users, the Microsoft Store will be sufficient, but include others like Firefox or Java if your environment requires them.

4. Update DoD Certificates

• Click the "Install Certificates" button. This will download the latest DoD certificates from DISA and automatically install them into the selected certificate stores.
• If you're updating, InstallRoot will overwrite outdated certificates and add any new certificates from the DoD.

5. Verify Installation

• After the installation is complete, you can verify that the certificates were updated successfully:
  • Navigate to the Microsoft Store tab and scroll through the list of installed certificates.
  • Ensure that the DoD root and intermediate certificates (e.g., DoD Root CA 3, DoD Root CA 4) are listed and valid.
• If you installed certificates in the Firefox or Java store, repeat the verification process within those tabs.

6. Close InstallRoot

• Once you’ve verified the certificates have been updated, you can close the InstallRoot application.

7. Testing the Certificates (Optional)

• To confirm that the certificates are functioning properly, try accessing a DoD website (e.g., https://www.dmdc.osd.mil).
• Ensure that your browser recognizes the DoD certificates and that there are no certificate-related errors when loading the page.

If you still experience problems, please let the CRL IT Team know by submitting a request for assistance here: https://crl.helpspot.com/index.php?pg=request