Frequently Asked Questions

• Will my PIV credentials break or need to be updated or replaced when this change occurs?
• Is the Federal Common Policy CA changing?
• When will this change happen?
• When will the certificates issued by the Federal Common Policy CA get revoked?
  • Issued to: Federal Bridge CA G4
  • Issued to: U.S. Department of State AD Root CA
  • Issued to: DigiCert Federal SSP Intermediate CA - G5
  • Issued to: Symantec SSP Intermediate CA - G4
  • Issued to: Verizon SSP CA A2
  • Issued to: ORC SSP 4
  • Issued to: US Treasury Root CA
  • Issued to: Entrust Managed Services Root CA
• Which types of systems will this change affect?
• Which operating systems will this change affect?
• What happens if I don’t distribute the FCPCA G2?
• What errors can occur in Windows if I don’t distribute the FCPCA G2?
• What errors can occur in macOS if I don’t distribute the FCPCA G2?
• What errors can occur in iOS if I don’t distribute the FCPCA G2?
• How can I verify that the FCPCA G2 has been successfully distributed to my workstation or device?
• My agency gets PIV cards from [Issuer Name]. I won’t be affected by this change, right?
• Why aren’t some Entrust Federal Shared Service Provider issued PIV credential certificates chaining to FCPCA G2?
• Do I need to distribute the FCPCA G2 to my Bring Your Own Device (BYOD) program device?
• How do I configure my unmanaged Windows system to trust the new Federal Common Policy CA G2?
• How do I configure my unmanaged macOS device to trust the new Federal Common Policy CA G2?
• How do I configure my unmanaged iOS device to trust the new Federal Common Policy CA G2?
• How do I configure the Firefox web browser to trust the new Federal Common Policy CA G2?

Will my PIV credentials break or need to be updated or replaced when this change occurs?

No. PIV credentials will not be affected by this change. For example, the graphic below shows the current and future state of certificate validation for a PIV credential issued by the USAccess Program. Although two certificates in the chain are being updated, the PIV credential certificates are not affected.

Is the Federal Common Policy CA changing?

Yes. In October 2020, the Federal Government established a new Federal Public Key Infrastructure (FPKI) Root Certification Authority (CA) known as the Federal Common Policy CA (FCPCA) G2.

Between December 2020 and June 2021, CAs cross-certified by the existing FCPCA will be migrated to the FCPCA G2. Once the migration is complete, the existing FCPCA will be decommissioned (planned for June 2021).

When will this change happen?

Timeline:

• October 14, 2020: The Federal PKI Management Authority (FPKIMA) established the new FCPCA G2.
• October 15, 2020: The FPKIMA issued and distributed a cross certificate from the FCPCA G2 to the Federal Bridge CA G4.
• November 18, 2020: The FPKIMA issued and distributed certificates to migrate agency and affiliate CAs cross-certified by the existing FCPCA to the FCPCA G2.
• December 2020 to June 2021: All agencies transition from using the existing FCPCA as a trust anchor to the FCPCA G2. Certificates issued by the Federal Common Policy CA will be revoked between the end of April and June in coordination with CA operators (revocation schedule below).
• June 2021: The FPKIMA decommissions the existing FCPCA.

When will the certificates issued by the Federal Common Policy CA get revoked?

The Federal Common Policy CA must revoke all active CA certificates it has issued in preparation for decommissioning. Details related to the CA certificates issued by the Federal Common Policy CA, to include planned revocation date, are listed below:

Note: This table was last updated on June 17, 2021. Follow our GitHub Issue for the latest information possible.

Issued to: Federal Bridge CA G4

Issued to: U.S. Department of State AD Root CA

Issued to: DigiCert Federal SSP Intermediate CA - G5

Issued to: Symantec SSP Intermediate CA - G4

Issued to: Verizon SSP CA A2

Issued to: ORC SSP 4

Issued to: US Treasury Root CA

Issued to: Entrust Managed Services Root CA

Which types of systems will this change affect?

This change will affect any system that requires the ability to validate certificates issued by the Federal PKI. This includes systems configured for Personal Identity Verification (PIV) credential authentication to government networks or web applications, systems that require the ability to verify digital signatures that leverage PIV or similar credentials, and systems that host applications or services that leverage the Federal Common Policy CA as a root CA.

Classified systems are not affected by this change.

Which operating systems will this change affect?

All major operating systems (i.e., Microsoft Windows, macOS, iOS, *nix) will be affected.

What happens if I don’t distribute the FCPCA G2?

1. (High Impact) Authentication failures
   • Workstations
   • Websites
   • Applications (internal and cross-agency)
   • Virtual Private Networks (VPNs)
2. (Medium Impact) Error fatigue
   • Unexpected application errors and system behavior for legacy and government-off-the-shelf (GOTS) products
3. (Low Impact) Digital signature validation failures
   • Email
   • Documents and files (for example, Microsoft Word)

What errors can occur in Windows if I don’t distribute the FCPCA G2?

Sample Chrome error when a user navigates to an intranet site whose SSL/TLS certificate doesn’t chain to a trusted root CA:

Sample Chrome error when PIV authentication fails because the user’s certificate doesn’t chain to a trusted root CA:

Sample Microsoft Outlook error when a digital signature certificate for an email doesn’t chain to a trusted root CA:

What errors can occur in macOS if I don’t distribute the FCPCA G2?

Sample Safari error when a user navigates to an intranet site whose SSL/TLS certificate doesn’t chain to a trusted root CA:

Sample Safari error where client (PIV) authentication fails because a user’s certificate doesn’t chain to a trusted root CA:

Sample Chrome error when a user navigates to an intranet site whose SSL/TLS certificate doesn’t chain to a trusted root CA:

Sample Chrome error where client (PIV) authentication fails because a user’s certificate doesn’t chain to a trusted root CA:

What errors can occur in iOS if I don’t distribute the FCPCA G2?

Sample Safari error when a user navigates to an intranet site whose SSL/TLS certificate doesn’t chain to a trusted root CA:

Sample Chrome error when a user navigates to an intranet site whose SSL/TLS certificate doesn’t chain to a trusted root CA:

How can I verify that the FCPCA G2 has been successfully distributed to my workstation or device?

Please review the steps to verify distribution of the FCPCA G2.

My agency gets PIV cards from [Issuer Name]. I won’t be affected by this change, right?

This change does not affect your PIV credential issuer, nor how agency credentials are generated or issued.

This change does affect how federal enterprise workstations and devices validate PIV credential certificates.

Why aren’t some Entrust Federal Shared Service Provider issued PIV credential certificates chaining to FCPCA G2?

Entrust Federal Shared Service Provider (SSP) PIV credential certificates issued before August 13, 2019, chain through an older version of the Entrust Managed Services Root CA on their way to the Federal Common Policy CA than certificates issued since. This older version of the Entrust Managed Services Root CA will not receive a certificate from the Federal Common Policy CA G2.

To ensure PIV credential certificates issued by the Entrust Federal SSP before August 13, 2019 validate to the Federal Common Policy CA G2, you should distribute this “link certificate” as an intermediate CA certificate. The link certificate allows workstations to build a path from the older Entrust Managed Services Root CA to the current version, which has been issued a certificate by the Federal Common Policy CA G2. Review how to distribute intermediate CA certificates here.

The graphic below shows a certificate chaining to the Federal Common Policy CA G2 through the Entrust Managed Services Root CA link certificate, denoted with a red asterisk (“ *.”)

Do I need to distribute the FCPCA G2 to my Bring Your Own Device (BYOD) program device?

As a BYOD program device user, you’ll need to distribute the FCPCA G2 if you:

• use your PIV credential to log into intranet sites or VPNs,
• validate PIV digital signatures in emails or documents, or
• navigate to intranet pages whose SSL/TLS certificates chain to the FCPCA G2.

How do I configure my unmanaged Windows system to trust the new Federal Common Policy CA G2?

1. Download a copy of the FCPCA G2 certificate from http://repo.fpki.gov/fcpca/fcpcag2.crt
2. Download the bundle of FPKI intermediate CA certificates for unmanaged devices (fpki-unmanaged-bundle.p7b)
3. Update your Trust Store:
   • Click Start, type certmgr.msc, and press Enter.
   • Right-click Trusted Root Certification Authorities (on the left-hand navigation), and select All Tasks > Import. Click Next once the Certificate Import Wizard opens.
   • Browse to and select your copy of the FCPCA G2. Click Next several times until the certificate import process is complete.
   • When prompted, verify the certificate thumbprint matches 99B4251E2EEE05D8292E8397A90165293D116028 (additional spaces may appear depending on your Windows Version).
   • Click Yes.
   • Right-click Intermediate Certification Authorities (on the left-hand navigation), and select All Tasks > Import. Click Next once the Certificate Import Wizard opens.
   • Browse to and select your copy of fpki-unmanaged-bundle.p7b, making sure “All Files” are presented to view the .p7b file (this appears in a drop-down box next to the “File Name” input box). Click Next several times until the certificate import process is complete.

To verify your distribution (assumes certmgr.msc is still open):

1. Verify an entry for the FCPCA G2
   • Use the left-hand navigation to browse to Trusted Root Certification Authorities > Certificates
   • Press the F5 key to refresh the folder contents
   • Verify an entry exists for the Federal Common Policy CA G2 (both the Issued To and Issued By columns will present “Federal Common Policy CA G2”.)
2. Verify entries for the intermediate CA certificates issued by the Federal Common Policy CA G2
   • Use the left-hand navigation to browse to Intermediate Certification Authorities > Certificates
   • Press the F5 key to refresh the folder contents
   • Sort the data by clicking on the Issued By column
   • Verify nine (9) entries for certificates issued by the Federal Common Policy CA G2

Note: The following .gif demonstrates the distribution steps outlined above.

How do I configure my unmanaged macOS device to trust the new Federal Common Policy CA G2?

1. Download a copy of fpki-unmanaged-bundle.mobileconfig
2. Browse to and double-click on your copy of fpki-unmanaged-bundle.mobileconfig.
3. Navigate to System Preferences -> Profiles
4. Verify the profile contents and click Install (twice)

Note:  The following video shows you how to install FCPCA G2 and the intermediate CA certificates using an Apple configuration profile on macOS.

How do I configure my unmanaged iOS device to trust the new Federal Common Policy CA G2?

1. Launch Safari.
2. Navigate to a copy of the fpki-unmanaged-bundle.mobileconfig

   System message says: The website is trying to open Settings to show you a configuration profile. Do you want to allow this?
   

3. Click Allow.
   
4. Navigate to Settings -> General -> Profile
5. Select the “Distribute FCPCAG2 and Intermediate CA Certificates” profile
6. Select More Details and select the certificate entry for the FCPCA G2
7. Scroll to Fingerprints and verify the certificate’s SHA-256 hash against the expected value.
8. At the top left of screen, click Back and Install Profile. Then, click Install (top right).
9. When prompted, enter your device passcode.
10. Click Install in the upper right corner, and Install again.
11. Click Done.
12. Enable full trust for the FCPCA G2.

Note:  The following video shows you how to install FCPCA G2 and the intermediate CA certificates using the Safari web browser.

How do I configure the Firefox web browser to trust the new Federal Common Policy CA G2?

The following steps will allow Firefox to use the underlying operating system trust store. Follow these steps only after distributing the Federal Common Policy CA G2 to your Windows or macOS device.

1. Open Firefox.
2. Enter about:config in the address bar and continue to the list of preferences.
3. Set the preference security.enterprise_roots.enabled to true.
4. Restart Firefox.

Note:  The following video shows you how to configure the Firefox web browser to trust the certificates included in the operating system trust store.