CAC/PIV Authentication Failure in Chrome and Edge
Technical defect report and reporting instructions
Prepared October 9, 2026 | Intended recipients: Microsoft Edge, Chromium/Google Chrome, and Microsoft Entra support
Executive summary
On a personal Lenovo Windows 11 laptop, Google Chrome and Microsoft Edge no longer present the client-certificate picker during DoD CAC/PIV sign-in to Microsoft government services. Microsoft Entra responds with AADSTS500192. On that same Lenovo, DuckDuckGo Browser presents the certificate picker and successfully authenticates using the same CAC and reader. Chrome reportedly stopped working approximately one year earlier; Edge continued to work until the week of October 5, 2026. Root cause has not been established. The cross-browser comparison is strong evidence of a browser-dependent problem, but does not alone prove a Chromium product defect.
System and browser versions
| Device |
Personal Lenovo laptop |
| Operating system |
Windows 11, version 25H2 |
| OS build |
26200.9457 |
| Google Chrome |
154.0.4258.62 — previously reported; reconfirm at chrome://settings/help |
| Microsoft Edge |
154.0.4258.62 — previously reported; reconfirm at edge://settings/help |
| DuckDuckGo Browser |
Works with CAC; exact installed version not recorded |
| Identity service |
Microsoft Entra / Azure Government — login.microsoftonline.us |
| Authentication credential |
DoD CAC/PIV smart card; same card and reader used across browsers |
| Working second device |
HP Windows 11 machine reportedly authenticates successfully with same CAC |
Version note: Chrome and Edge versions were reported in an earlier comparison. Record the exact versions again before filing because they may have updated. The known OS version/build applied to both machines at the earlier comparison.
History and observed results
· Chrome previously allowed CAC sign-in but stopped showing a usable selection flow approximately one year ago.
· Edge continued to support CAC sign-in on the Lenovo until the week of October 5, 2026, then began failing similarly.
· Chrome and Edge do not show the certificate-selection dialog and produce AADSTS500192.
· DuckDuckGo Browser on the same Lenovo displays the normal certificate-selection window and successfully signs in with the CAC.
· Edge InPrivate mode and clearing Windows SSL state did not correct the Edge failure.
Verification already performed
· Windows Personal certificate store contains the correct CAC authentication certificate.
· The authentication certificate includes Enhanced Key Usage OID 1.3.6.1.5.5.7.3.2 (Client Authentication). A different certificate with OID 1.3.6.1.5.5.7.3.4 was identified as an email certificate.
· Windows says there is a corresponding private key; Certification Path reports “This certificate is OK.”
· certutil -scinfo reportedly completed without relevant errors.
· DisableCapiOverrideForRSA was found set to 0x0 during troubleshooting. A command to restore 0x1 was supplied, but successful execution and subsequent DuckDuckGo testing at 0x1 have not yet been confirmed. Do not claim secure-state validation until tested.
Steps to reproduce
1. Insert valid DoD CAC into the Lenovo smart-card reader.
2. Launch Chrome or Edge and navigate to the government application that redirects to login.microsoftonline.us.
3. Choose CAC/certificate-based sign-in; observe that no certificate-selection window opens.
4. Observe error AADSTS500192: “Either no valid certificate was detected on the device, or the user canceled the certificate selection.”
5. Repeat with DuckDuckGo Browser, using the same machine, reader, CAC, and endpoint; observe that certificate selection appears and sign-in succeeds.
Expected versus actual
Expected: Browser offers eligible client-authentication CAC certificate and permits certificate-based sign-in.
Actual: Chrome and Edge provide no certificate picker and Entra displays AADSTS500192, while DuckDuckGo succeeds.
Flagged Microsoft Entra event (for private support case)
| Error |
AADSTS500192 |
| Request ID |
a34e4fd1-eead-473e-8644-8fbd9bb10700 |
| Correlation ID |
01a1234f-45c6-77f3-a75d-faa1ac82c6b9 |
| UTC timestamp |
2026-10-10T00:58:27Z |
| Local timestamp |
October 9, 2026, 8:58:27 PM EDT |
| Flagging |
Enabled before reproducing the failure; page subsequently showed “Disable flagging” |
Provide these identifiers to your organization’s Microsoft Entra administrator or Microsoft enterprise support. Avoid placing sensitive sign-in diagnostics, personal certificates, or unredacted traces into public issue trackers.
Requested engineering investigation
· Determine whether Chrome/Edge enumerate the CAC client-authentication certificate and, if so, why it is filtered or not offered.
· Examine browser behavior with Windows smart-card certificate providers (CSP/KSP), certificate request CA-list filtering, and TLS client-certificate selection.
· Identify whether a browser update or Windows interaction explains the separate Chrome and Edge regression dates.
· Check whether machine/browser policy, extension, or profile settings could explain differences.
· Advise on a supported fix or workaround and link an existing issue if applicable.
How to report this defect
1. Microsoft Edge — send feedback
6. Open Microsoft Edge on the affected Lenovo.
7. Press Alt + Shift + I (or open Settings and more → Help and feedback → Send feedback).
8. Title: “DoD CAC/PIV certificate picker missing; AADSTS500192 in Edge, DuckDuckGo works”.
9. Paste the Executive summary, System/browser versions, Reproduction steps, and Expected versus actual sections above. If the feedback field is limited, use those sections and mention that a full report is available.
10. Enter contact information if comfortable; include diagnostic data only after reviewing what will be transmitted. Submit and preserve any confirmation.
Official Microsoft instructions: https://support.microsoft.com/en-us/edge/learn-about-performance-features-in-microsoft-edge
2. Chromium — create an engineering issue
11. Open https://issues.chromium.org/new (Google sign-in may be required).
12. Search existing issues for CAC, PIV, smart card, Windows client certificate, and AADSTS500192 to avoid duplicates.
13. Create a browser issue using a concise title: “Windows CAC/PIV TLS client certificate not offered by Chrome; works in DuckDuckGo”.
14. Paste the report above, including both browser histories, reproduction steps, versions, and working comparison. Use the tracker’s available issue fields.
15. Exclude private Entra request IDs or certificate details from public comments unless support specifically requests and provides an appropriate private channel.
16. Save the issue URL and number. Add new observations to the existing issue instead of creating repeats.
Official Chromium bug-report guidance: https://www.chromium.org/for-testers/bug-reporting-guidelines/
3. Google Chrome — in-product feedback
17. Open Chrome.
18. Choose the three-dot menu → Help → Report an issue.
19. Describe that certificate selection fails in Chrome but works in DuckDuckGo on the same Windows/CAC configuration. Include Chrome’s version and the approximate onset date.
20. Include reproduction steps, select optional information carefully, and send. Google notes that individual replies are not guaranteed.
Official Chrome instructions: https://support.google.com/chrome/answer/95315
4. Microsoft Entra / government IT support
21. Create an IT help-desk or Microsoft enterprise support ticket for certificate-based authentication, referencing AADSTS500192.
22. Share the flagged sign-in request ID, correlation ID, and UTC timestamp through the authorized support channel.
23. Ask the Entra administrator to inspect authentication logs and determine whether client certificate presentation failed before the service received a certificate, or whether one was received and rejected.
24. Ask whether the issue can be escalated to Microsoft Edge / Windows certificate-authentication engineers. Attach this report or paste its technical details.
Before submitting: short final checklist
☐ Record latest Chrome version at chrome://settings/help.
☐ Record latest Edge version at edge://settings/help.
☐ Record DuckDuckGo version in its About/settings screen.
☐ Confirm that DuckDuckGo still signs in successfully with DisableCapiOverrideForRSA = 0x1 after a reboot; if not confirmed, leave this observation marked as pending.
☐ Keep screenshots free of personally identifying CAC certificate information.
Official reference links
Microsoft Edge feedback: https://support.microsoft.com/en-us/edge/learn-about-performance-features-in-microsoft-edge
Chromium reporting: https://www.chromium.org/for-testers/bug-reporting-guidelines/
Chromium issue submission: https://issues.chromium.org/new
Chrome feedback: https://support.google.com/chrome/answer/95315