---
project: cac-manjaro-thinkpad
type: tech-setup
status: completed
path: Tech/Sessions
tags:
  - cac
  - manjaro
  - thinkpad
  - pcscd
  - opensc
  - firefox
created: 2026-04-15
updated: 2026-04-15
---

# CAC Setup — Manjaro ThinkPad

## Overview

CAC authentication configured and working on Manjaro ThinkPad using
OpenSC + pcscd. Tested against Office 365 / DoD sites via Firefox.

## Stack

- **Middleware:** pcscd (pcsc-lite)
- **PKCS#11 module:** OpenSC — `/usr/lib/opensc-pkcs11.so`
- **Browser:** Firefox
- **Test tool:** pcsc_scan (pcsc-tools)

## Working Session Flow

1. Ensure pcscd is running:
   ```bash
   sudo systemctl start pcscd
   ```

2. Verify card is detected (keep running in terminal):
   ```bash
   pcsc_scan
   ```
   Confirm reader and card state are both visible before proceeding.

3. Open Firefox and navigate to CAC-protected site — certificate
prompt should appear.

## Firefox PKCS#11 Module

One-time setup (persists across sessions, but may reset after Firefox updates):

1. Firefox → Preferences → Privacy & Security
2. Scroll to **Security** section → click **Security Devices**
3. Click **Load**
4. Module name: `DoD CAC`
5. Module filename: `/usr/lib/opensc-pkcs11.so`

> **Note:** Firefox updates have been observed to clear this setting. If CAC auth stops working after a Firefox update, re-load the module using the steps above before troubleshooting anything else.

## Enable pcscd on Boot

Run once so the daemon starts automatically — eliminates step 1 above
on future sessions:

```bash
sudo systemctl enable pcscd
```

## Troubleshooting

| Symptom | Fix |
|---|---|
| `pcsc_scan` shows no reader | Check USB connection, try `sudo
systemctl restart pcscd` |
| Reader visible but card not detected | Remove and reinsert CAC |
| Firefox not prompting for cert | Re-load OpenSC module in Security
Devices (see above) |
| pcscd daemon crashed | `sudo systemctl restart pcscd`, then re-run
`pcsc_scan` |

## References

- https://militarycac.com/linux.htm
- https://wiki.archlinux.org/title/Common_Access_Card
- https://github.com/jdjaxon/linux_cac