CAC Reader Not Working on Mac? Fix It in 5 Minutes

If your CAC reader is not working on Mac, I can tell you exactly what’s wrong — because I troubleshoot this problem roughly a dozen times a week. Working IT support on a military installation means I get called over to someone’s desk while their coffee goes cold and they’re locked out of a system they needed access to ten minutes ago. The fix is almost always one of four things, and I’m going to walk you through all of them in the order I actually use them.

Grab your reader, your CAC, and maybe that cold coffee. Let’s get into it.

Quick Fix — Restart and Reconnect

Frustrated by a blinking reader light and zero response from Keychain Access, most people I help have already tried unplugging and plugging back in — but they haven’t done it in the right order. Sequence matters here more than people expect.

Here’s the exact order I use every single time:

Remove your CAC from the reader first. Don’t just yank the whole reader out — take the card out while the reader is still connected.
Unplug the reader from the Mac.
Do a full restart of the Mac. Not sleep. Not log out. A full restart.
Once you’re back at the desktop, plug the reader into a different USB port than the one you used before.
Wait 20 full seconds. I count out loud. People look at me funny, but it works.
Insert the CAC.

The reason the port swap matters: macOS caches USB device states in a way that can get stuck on a specific port. Switching ports forces a fresh enumeration of the device. On a MacBook Pro or MacBook Air with only USB-C ports, if you’re using a hub, try going directly to the machine without the hub first. Hubs are responsible for more phantom CAC issues than most people realize.

Clean the Card Chip

This one sounds too simple. It isn’t. The gold chip on a CAC takes a beating — wallets, humidity, the pocket of someone’s ABU pants for three years. Oxidation builds up on the contacts and causes intermittent read failures that look exactly like a software problem.

Get a standard pencil eraser — the pink kind on the end of a No. 2 pencil, not a mechanical pencil eraser. Rub the gold chip contacts gently about ten times. You’ll see light gray streaks on the eraser. That’s oxidation coming off. Wipe the chip with a dry cloth, reinsert.

I started carrying a pencil specifically for this. Three dollars at the BX. It fixes the problem about 20% of the time all by itself.

Test With a Known-Good Reader

Before you spend an hour troubleshooting software, rule out hardware. If you have access to another CAC reader — borrow one from a coworker — swap it in. If the second reader reads your card immediately, your reader is the problem, not macOS. Skip to the last section where I cover replacement options.

macOS Sonoma and Sequoia Specific Issues

Okay, probably should have opened with this section, honestly — if you updated to macOS 14 (Sonoma) or macOS 15 (Sequoia) and your CAC reader stopped working right after, you are not imagining things. Apple changed how macOS handles certain USB smart card readers at the driver level, and a lot of readers that worked fine on Ventura just don’t work cleanly anymore without some intervention.

The most common affected readers are the SCR3500 series from HID, older Identiv uTrust readers, and basically any reader over four years old that relies on the PC/SC architecture without updated firmware.

Check That the Smart Card Driver Is Actually Loading

Open Terminal. You’ll find it in Applications > Utilities, or just Spotlight search it. Run this command:

system_profiler SPSmartCardsDataType

If your reader is being detected at all, you’ll see output that includes the reader name and card state. If you see nothing — just a blank return — macOS isn’t seeing the reader at the driver level. That’s a different problem than a certificate issue.

If the reader shows up but the card doesn’t, run:

sc_auth identities

This forces macOS to query the smart card for identities. If it returns an error about the token or module, the native Apple CryptoTokenKit driver is conflicting with whatever middleware you have installed.

The CryptoTokenKit Conflict Fix

On macOS 14 and 15, Apple’s built-in CryptoTokenKit tries to handle CAC authentication natively. That sounds great. In practice, when you also have DoD middleware like Thursby’s PKard or HID ActivClient installed, they fight over the card and neither wins.

To disable the Apple native driver temporarily and let your third-party middleware take over, run this in Terminal:

sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array com.apple.CryptoTokenKit.pivtoken

You’ll be prompted for your admin password. After you enter it, restart the Mac and try the reader again. This single command has fixed the problem for probably 40% of the Sonoma and Sequoia users I’ve worked with.

To undo it later if needed:

sudo defaults delete /Library/Preferences/com.apple.security.smartcard DisabledTokens

Middleware Version Compatibility

If you’re running HID ActivClient, make sure you’re on version 7.3.4 or later. Earlier versions have a known incompatibility with macOS 14.4 and above. The installer is available through your organization’s IT portal or directly from HID Global’s support site. The PKard for Mac product from Thursby has similar version requirements — anything below version 4.4.2 will cause intermittent failures on Sonoma.

Don’t skip this step. I watched a colleague spend three hours on Terminal commands when the fix was a 12-minute middleware update.

Certificate and Keychain Problems

Here’s something that trips up a lot of people: the CAC reader works fine, the card is being read correctly, but authentication still fails. The browser shows a certificate error, or the login page never prompts for a PIN. Nine times out of ten, this is either a system clock issue or a corrupted login keychain.

Check Your System Time First

Incorrect system time is the single most common cause of certificate validation errors. CAC certificates are time-sensitive. If your Mac’s clock is off by more than a few minutes, the certificate chain fails validation and the whole thing looks broken even though nothing is actually broken.

Go to System Settings > General > Date & Time. Make sure “Set time and date automatically” is turned on and that your time zone is correct. If you’re on a network that blocks NTP (some restricted environments do), you’ll need to set the time manually and make sure it’s exact.

Check the time against time.gov. That’s the authoritative US time source. If your clock is off by more than 30 seconds, fix it before doing anything else.

Reset the Login Keychain

I learned this the hard way after a macOS update corrupted my own login keychain and I spent 45 minutes convinced my CAC was dead. The keychain stores cached certificate information, and when it gets corrupted or holds onto expired entries, it blocks new authentications even when the card is perfectly healthy.

Here’s how to reset it:

Open Keychain Access from Applications > Utilities.
In the left sidebar, right-click on “login” under Keychains.
Select “Change Settings for Keychain ‘login’.”
If that doesn’t resolve things, go to Keychain Access menu > Preferences > Reset My Default Keychains.

Warning: resetting your default keychain will delete saved passwords stored in it. Make sure you know your passwords before you do this, or that they’re stored somewhere else like 1Password or your organization’s credential manager.

Install the DoD Root Certificates

If the DoD root CA certificates aren’t installed in your system keychain, your Mac won’t trust the certificate chain on your CAC and every authentication attempt will fail. The DoD Cyber Exchange (public.cyber.mil) maintains the current certificate bundle — look for the “InstallRoot” tool or the certificate bundle under the PKI/PKE section.

After installing, open Keychain Access and search for “DoD Root” in the System keychain. You should see multiple entries. If you see any marked with a red X, right-click them, select Get Info, expand the Trust section, and set “When using this certificate” to “Always Trust.”

Annoying manual step. Yes. Necessary. Yes.

When to Replace Your Reader

There’s a point where troubleshooting stops being productive. Knowing when you’ve crossed that line saves real time. Here’s how I distinguish a software problem from a hardware failure.

Signs the Reader Itself Has Failed

The reader works on a Windows machine but not on any Mac you try it on — this actually points to a driver issue, not hardware failure.
The reader doesn’t show up at all in system_profiler SPUSBDataType output — macOS sees nothing connected. That’s usually hardware.
The reader light doesn’t illuminate when plugged in at all — on most readers, the LED should at least show a power state.
You can feel physical looseness in the card slot — the contact pins inside wear down after a few thousand insertions.
Different CACs all fail in the same reader, but work fine in a different reader — the reader contacts are worn.

One More Thing Before You Order a Replacement

Try the suspected bad reader on a Windows machine first. Borrowed by a coworker for five minutes, plugged into a Windows PC, card inserted — if it works fine there, the reader isn’t dead. Go back through the macOS-specific steps above. If it fails on Windows too, now you have clear confirmation the hardware is gone and you can order with confidence.

Most of the time, when someone comes to me convinced their reader is dead, it’s a Sonoma driver conflict or a keychain issue. Hardware failure is actually the least common cause. Work through the software fixes first, take the ten minutes, and save yourself the $35 if you don’t have to spend it.