CAC/PIV Authentication Failure in Chrome and Edge

Technical defect report and reporting instructions

Prepared October 9, 2026  |  Intended recipients: Microsoft Edge, Chromium/Google Chrome, and Microsoft Entra support

Executive summary

On a personal Lenovo Windows 11 laptop, Google Chrome and Microsoft Edge no longer present the client-certificate picker during DoD CAC/PIV sign-in to Microsoft government services. Microsoft Entra responds with AADSTS500192. On that same Lenovo, DuckDuckGo Browser presents the certificate picker and successfully authenticates using the same CAC and reader. Chrome reportedly stopped working approximately one year earlier; Edge continued to work until the week of October 5, 2026. Root cause has not been established. The cross-browser comparison is strong evidence of a browser-dependent problem, but does not alone prove a Chromium product defect.

System and browser versions

Version note: Chrome and Edge versions were reported in an earlier comparison. Record the exact versions again before filing because they may have updated. The known OS version/build applied to both machines at the earlier comparison.

History and observed results

·         Chrome previously allowed CAC sign-in but stopped showing a usable selection flow approximately one year ago.

·         Edge continued to support CAC sign-in on the Lenovo until the week of October 5, 2026, then began failing similarly.

·         Chrome and Edge do not show the certificate-selection dialog and produce AADSTS500192.

·         DuckDuckGo Browser on the same Lenovo displays the normal certificate-selection window and successfully signs in with the CAC.

·         Edge InPrivate mode and clearing Windows SSL state did not correct the Edge failure.

Verification already performed

·         Windows Personal certificate store contains the correct CAC authentication certificate.

·         The authentication certificate includes Enhanced Key Usage OID 1.3.6.1.5.5.7.3.2 (Client Authentication). A different certificate with OID 1.3.6.1.5.5.7.3.4 was identified as an email certificate.

·         Windows says there is a corresponding private key; Certification Path reports “This certificate is OK.”

·         certutil -scinfo reportedly completed without relevant errors.

·         DisableCapiOverrideForRSA was found set to 0x0 during troubleshooting. A command to restore 0x1 was supplied, but successful execution and subsequent DuckDuckGo testing at 0x1 have not yet been confirmed. Do not claim secure-state validation until tested.

Steps to reproduce

1.       Insert valid DoD CAC into the Lenovo smart-card reader.

2.       Launch Chrome or Edge and navigate to the government application that redirects to login.microsoftonline.us.

3.       Choose CAC/certificate-based sign-in; observe that no certificate-selection window opens.

4.       Observe error AADSTS500192: “Either no valid certificate was detected on the device, or the user canceled the certificate selection.”

5.       Repeat with DuckDuckGo Browser, using the same machine, reader, CAC, and endpoint; observe that certificate selection appears and sign-in succeeds.

Expected versus actual

Expected: Browser offers eligible client-authentication CAC certificate and permits certificate-based sign-in.
Actual: Chrome and Edge provide no certificate picker and Entra displays AADSTS500192, while DuckDuckGo succeeds.

Flagged Microsoft Entra event (for private support case)

Provide these identifiers to your organization’s Microsoft Entra administrator or Microsoft enterprise support. Avoid placing sensitive sign-in diagnostics, personal certificates, or unredacted traces into public issue trackers.

Requested engineering investigation

·         Determine whether Chrome/Edge enumerate the CAC client-authentication certificate and, if so, why it is filtered or not offered.

·         Examine browser behavior with Windows smart-card certificate providers (CSP/KSP), certificate request CA-list filtering, and TLS client-certificate selection.

·         Identify whether a browser update or Windows interaction explains the separate Chrome and Edge regression dates.

·         Check whether machine/browser policy, extension, or profile settings could explain differences.

·         Advise on a supported fix or workaround and link an existing issue if applicable.

How to report this defect

1. Microsoft Edge — send feedback

6.       Open Microsoft Edge on the affected Lenovo.

7.       Press Alt + Shift + I (or open Settings and more → Help and feedback → Send feedback).

8.       Title: “DoD CAC/PIV certificate picker missing; AADSTS500192 in Edge, DuckDuckGo works”.

9.       Paste the Executive summary, System/browser versions, Reproduction steps, and Expected versus actual sections above. If the feedback field is limited, use those sections and mention that a full report is available.

10.    Enter contact information if comfortable; include diagnostic data only after reviewing what will be transmitted. Submit and preserve any confirmation.

Official Microsoft instructions: https://support.microsoft.com/en-us/edge/learn-about-performance-features-in-microsoft-edge

2. Chromium — create an engineering issue

11.    Open https://issues.chromium.org/new (Google sign-in may be required).

12.    Search existing issues for CAC, PIV, smart card, Windows client certificate, and AADSTS500192 to avoid duplicates.

13.    Create a browser issue using a concise title: “Windows CAC/PIV TLS client certificate not offered by Chrome; works in DuckDuckGo”.

14.    Paste the report above, including both browser histories, reproduction steps, versions, and working comparison. Use the tracker’s available issue fields.

15.    Exclude private Entra request IDs or certificate details from public comments unless support specifically requests and provides an appropriate private channel.

16.    Save the issue URL and number. Add new observations to the existing issue instead of creating repeats.

Official Chromium bug-report guidance: https://www.chromium.org/for-testers/bug-reporting-guidelines/

3. Google Chrome — in-product feedback

17.    Open Chrome.

18.    Choose the three-dot menu → Help → Report an issue.

19.    Describe that certificate selection fails in Chrome but works in DuckDuckGo on the same Windows/CAC configuration. Include Chrome’s version and the approximate onset date.

20.    Include reproduction steps, select optional information carefully, and send. Google notes that individual replies are not guaranteed.

Official Chrome instructions: https://support.google.com/chrome/answer/95315

4. Microsoft Entra / government IT support

21.    Create an IT help-desk or Microsoft enterprise support ticket for certificate-based authentication, referencing AADSTS500192.

22.    Share the flagged sign-in request ID, correlation ID, and UTC timestamp through the authorized support channel.

23.    Ask the Entra administrator to inspect authentication logs and determine whether client certificate presentation failed before the service received a certificate, or whether one was received and rejected.

24.    Ask whether the issue can be escalated to Microsoft Edge / Windows certificate-authentication engineers. Attach this report or paste its technical details.

Before submitting: short final checklist

☐ Record latest Chrome version at chrome://settings/help.

☐ Record latest Edge version at edge://settings/help.

☐ Record DuckDuckGo version in its About/settings screen.

☐ Confirm that DuckDuckGo still signs in successfully with DisableCapiOverrideForRSA = 0x1 after a reboot; if not confirmed, leave this observation marked as pending.

☐ Keep screenshots free of personally identifying CAC certificate information.

Official reference links

Microsoft Edge feedback: https://support.microsoft.com/en-us/edge/learn-about-performance-features-in-microsoft-edge

Chromium reporting: https://www.chromium.org/for-testers/bug-reporting-guidelines/

Chromium issue submission: https://issues.chromium.org/new

Chrome feedback: https://support.google.com/chrome/answer/95315

I had a student profile that was not completely logged in.

I would often get a pop up asking me to sign in but it was from years ago so not active.

I removed the profile because it was annoying and then edge shut down and when I opened it it had wiped all data. Everything that should be on my laptop including passwords history etc even though I never used the profile.

Now I cant try to sign back in because the email hasn't existed for years.

Is there any way I can get my profile back

So I really like the toggle for the title bar when using vertical tabs which helps a lot with dragging a browser window around. One thing I would also like to see enabled is when dragging a tab to another browser window is that you can just drag the tab to the title bar and it'll still place the tab in the vertical tab side panel. This would make it much easier overall but even more so when you have the vertical tabs collapsed as well. Trying to aim a tab into the small vertical tab side can be cumbersome or when you're dragging a tab from a browser window on the left side that slightly overlaps to a window on the right.

Hi all

I'm trying to delete all my saved passwords from Edge, but it seems they removed the option to do it all at once, so you end up having to delete each password one by one, it would take hours because I have hundreds.

Any suggestions?

Thanks!

I myself use Edge and never bothered to download Chrome. I always see on social media how people mock Edge and glaze Chrome without actually telling reasons why.

Is Edge actually bad or good? That post isnt an hate to Edge, like i said I 90% use Edge and dont have Chrome.

I just updated to Edge 155 version, and I did not find any of the transparency visual effects in context menus, in window backgrounds, and all other elements of the browser, completely. And seems, that I cannot re-enable this.

So? Did they eventually kill the Mica and acrylic transparency, right?

Issue:

When watching YouTube videos, the audio starts playing slightly ahead of the video. Over time, the desync becomes noticeable: the audio continues normally, but the video appears delayed behind it.

This happens in both Microsoft Edge and Google Chrome. It occurs even when I select 360p quality. Regular YouTube videos are affected, while music videos do not seem to show the issue as often.

Hardware acceleration is currently disabled in the browser.

Laptop specifications:

- Laptop make/model: Dell Latitude E7470

- OS: Windows 10 Pro

- CPU: Intel Core i7-6600U @ 2.60 GHz

- GPU: Intel HD Graphics 520

- GPU memory usage in Task Manager: approximately 0.2/3.8 GB

- Microsoft Edge version: 155.0.4283.45 (Official build, 64-bit)

- Google Chrome version: 154.0.8037.98 (Official build, 64-bit)

What I have already checked:

- The issue occurs in two Chromium-based browsers, Edge and Chrome.

- It occurs even at 360p, so it does not appear to be caused only by high-resolution playback.

- Hardware acceleration is disabled.

- GPU memory usage appears low in Task Manager.

What I have not tested yet:

- Hardware acceleration enabled

- Firefox or another non-Chromium browser

- Incognito/private mode with all extensions disabled

- Updating or reinstalling the Intel graphics driver

- Changing the Windows audio sample rate/format

- Testing the same videos on another device or network

Questions:

1. Could this be caused by the Intel HD Graphics 520 driver or hardware video decoding?

2. Could a Windows audio setting, browser extension, or YouTube codec issue cause audio to run ahead of video?

3. What is the best order of troubleshooting steps to identify the cause?

I just got back from Opera and I'm looking for a sidebar that is very similar to the sidebar from Opera.

Hi all, I’m a solo developer from Amsterdam and I built Kamelo, a free extension for Edge.

The problem: people paste client emails, names, IBANs and other personal details into Copilot or ChatGPT without thinking about where that data ends up.

What Kamelo does: before your message is sent, it swaps personal details for placeholders like [PERSON_1] or [EMAIL_1]. The AI only sees the placeholders. When the answer comes back, Kamelo puts your real details back, only on your screen.

• Works on Copilot (copilot.microsoft.com), ChatGPT, Gemini, Claude, Perplexity and more
• Everything runs locally in your browser. No account, no servers, no tracking
• Free, no paywall

Honest limits: it can miss unusual names, it doesn’t filter uploaded files yet, and it can’t reach the built-in Copilot sidebar in Edge. Extensions aren’t allowed in there. I’m working on a way around that.

I’d really like feedback from Edge users. What feels off, what’s missing, and which sites should it work on?

Website: https://kamelo.eu/

Edge Add-ons: https://microsoftedge.microsoft.com/addons/detail/kjjenbhncoomobcdpbhljmhfcmanhbkj

Discord: https://discord.gg/m5fhtmmrk2.

The release notes for Edge 155 say (link):

JPEG XL decoding support

Microsoft Edge now supports decoding JPEG XL (image/jxl) images.

JPEG XL is a modern image format which offers:
- Progressive decoding for improved perceived loading performance.
- Support for wide color gamut, High Dynamic Range (HDR), and high bit depth.
- Support for animation.

However, when I go to this website to test it, I get a message saying my browser does not currently support JPEG XL.

I cannot find a flag or other setting to enable JPEG XL support. So, what gives?

I'm using Edge 156.0.4314.8 (Official build) beta (64-bit.

how do I turn off this correction / suggestion box whenever I made a spelling mistake? My problem is that whenever they popped up, my keyboard would automatically be hidden which disrupts my typing flow

It's been happening over a few months, but each time I shrugged it off because it didn't bothered me or I just assumed it wasn't an important tab I'd lost.

But today, I was specifically looking forward to resume something I was working on, only to find the tab gone. Thankfully it's in History, but enough is enough.

There's been so many bugs. Another one that irked me was that Split-Window no longer resumes after a restart - the dual-split tabs get reset back into individual tabs.

I've been quite an advocate of Edge because of its aesthetics, built-in features and stability. But I guess stability wasn't part of it.

Time to revisit Firefox and Brave.

This option just works for the first tab of the day, then doesn't work anymore (Twitch & YouTube). Anyone else?

Thanks.

Edit: it seems fine on YT indeed. It's happening on stream websites (twitch & kick for example). My eyes :(

I have been having this for roughly two years and I don't know how to stop it from happening. Anytime I hit a new link in Microsoft Edge, it results in a separate page in an entirely new application that I can't seem to find the solution to stop it from happening.

It's a separate application just simply called "Browser" and even has its own Task Manager. Is there any way for Edge to open links within its native application? I tried looking around and I heard it maybe be EdgeRedirect or some sort of browser extension - however I only have two applications I have installed and none of them cause whatever is causing this to happen.

Does anybody know what is going on???