An “expired CAC certificate” message can describe three different problems: the physical CAC has expired, a certificate on the card is no longer valid, or the computer is using an old or untrusted certificate chain. Check which condition applies before deleting certificates or scheduling an appointment.
1. Check the date printed on the CAC
If the physical card is expired, damaged or no longer tied to an eligible affiliation, browser and certificate-store changes will not restore it. Use the official ID Card Office Locator to find a RAPIDS facility and review that location’s appointment and document requirements.
2. Identify the certificate that failed
A CAC can present certificates for authentication, signing and encryption. The error may name the certificate, show its validity dates or indicate that no acceptable client certificate was presented.
On an authorized Windows system, certutil -scinfo can enumerate the reader, card and certificates. Browser certificate details can also show the issuer and validity dates. Do not publish screenshots containing names, identifiers or certificate serial numbers.
3. Distinguish expiration from trust failure
| Evidence | Likely issue |
|---|---|
| CAC’s printed expiration date has passed | Card renewal or replacement through an ID-card office |
| User certificate’s “Valid to” date has passed | Credential update or card service through authorized DoD channels |
| Certificate date is current, but chain is untrusted | Missing or stale DoD CA certificates |
| Certificate is current and trusted, but one site rejects it | Wrong certificate selection, account authorization or site-side problem |
4. Use ID Card Office Online correctly
The official ID Card Office Online portal provides:
- RAPIDS office search and appointment links for CAC issuance or renewal.
- A CAC email-address update.
- Joint Data Model applet installation.
- Academy Student certificate extension.
It does not advertise general mail delivery of a replacement CAC. Do not submit personal information to a third-party “renewal” site.
5. When an email-address update may help
DMDC states that a CAC holder can correct the Primary Personnel Email address in DEERS and on CAC certificates by signing in to ID Card Office Online. This is an email-data update, not a universal remedy for an expired physical card or every expired credential.
6. Fix a DoD trust-chain problem
If the user certificate is within its validity period but the browser reports an untrusted issuer or incomplete chain, use current DoD Cyber Exchange guidance and CA files. Install only official certificates into the trust store used by the affected browser or application.
Chrome and Edge on Windows commonly use the Windows certificate store; Firefox can use a separate store. See the DoD certificate update guide.
7. Clear stale selection without deleting unrelated credentials
After an authorized card or certificate update:
- Remove the CAC.
- Close all browser windows.
- Reconnect the reader and insert the card.
- Reopen the official service and select the current authentication certificate.
Do not indiscriminately delete Windows Credential Manager entries, personal certificates or encryption keys. Removing unrelated credentials can cause data loss or additional sign-in failures.
8. What “your credentials could not be verified” means
This is a general authentication failure, not proof that the CAC expired. Check the card and certificate dates, certificate trust, revocation status, correct certificate selection and the destination service. On a managed computer, provide the exact error and timestamp to the help desk.
When to visit a RAPIDS office
Use an ID-card office when the physical CAC is expired or damaged, the card is unreadable on known-working equipment, the official portal directs you to in-person service, or your personnel/security office says reissuance is required. Requirements vary by status and location, so use the locator’s official details rather than a generic document checklist.
CAC expiration FAQ
Can a valid-looking CAC still have a certificate problem?
Yes. Certificate validity, revocation, trust and account authorization are separate checks from the date printed on the physical card.
Can I renew any expired CAC entirely online?
ID Card Office Online directs CAC issuance and renewal to the office locator. It lists only specific online CAC updates. Follow the current options shown for your credential and status.
Will reinstalling ActivClient renew a certificate?
No. Middleware can help an application use a certificate, but it cannot extend an expired credential or physical card.
Where should I start?
Start at the official RAPIDS ID Card Office Online portal. For general renewal planning, see How to Renew Your CAC in 2026.
Leave a Reply