How to Fix CAC Signing Failures in Adobe Acrobat on macOS
Question details
Users experience digital signature failures in Adobe Acrobat when attempting to use CAC or PIV smart cards after upgrading to macOS 10.11.6.
- Product
- Adobe Acrobat
- Device & OS
- macOS 10.11.6
- Scenario
- Applying a digital signature to a PDF document using a DOD CAC or PIV smart card reader.
- Observed behavior
- Acrobat fails to recognize the certificate or complete the digital signature process, even though the smart card works properly for email signing elsewhere in the system.
Ensure your smart card reader is securely connected to your Mac and that you have administrative privileges to modify system file permissions via Terminal.
Update CACKey Middleware and Attach the PKCS#11 Module
Use this method to resolve signature failures caused by outdated cryptographic hashing algorithms by updating CACKey and linking it directly in Adobe Acrobat.
macOS 10.11.6 introduced stricter cryptographic behaviors that require SHA-256 support. Updating to CACKey version 0.7.8 or later and manually linking the PKCS#11 module will restore signing functionality.
Download and install CACKey version 0.7.8 or newer to ensure compatibility with SHA-256 algorithms required by newer macOS versions.
Open the Terminal application and execute the following commands to ensure correct ownership: 'sudo chown root:admin /Library/CACKey/libcackey.dylib' followed by 'sudo chmod 755 /Library/CACKey/libcackey.dylib'.
Open Adobe Acrobat or Adobe Reader DC. Navigate to Preferences > Signatures > Identities & Trusted Certificates, and click the 'More' button.
Select 'PKCS#11 Modules and Tokens' in the left pane, then click 'Attach Modules'. Enter the exact path '/Library/CACKey/libcackey.dylib' and click OK.
Expand the newly added module to reveal your smart card. Select your DOD EMAIL CA email-signing certificate, click 'Usage Options', and choose 'Use for Signing'.
Configure Alternative Middleware (e.g., Centrify)
Apply this solution if your environment uses Centrify or other third-party smart card middleware instead of CACKey.
Digitally Sign PDFs Seamlessly with WPS Office
If you are struggling with complex middleware configurations and Acrobat errors, WPS Office provides a straightforward and powerful PDF editor to manage your digital signatures securely and efficiently.
- 1. Open your PDF: Launch WPS Office and open the PDF document you need to digitally sign.
- 2. Navigate to Protect: Click on the 'Protect' tab located in the top menu ribbon of the PDF interface.
- 3. Add Digital Signature: Select 'Digital Signature', choose your validated certificate from the system, and click on the document to place your signature securely.
Frequently Asked Questions
Why did my CAC card stop working in Acrobat after updating macOS?
System updates like macOS 10.11.6 introduce stricter cryptographic requirements, such as mandating SHA-256 algorithms. Older versions of smart card middleware (like CACKey prior to 0.7.8) fail to meet these new standards, causing the signature process to break.
Where should I enter my CAC PIN when signing in Acrobat?
Once you have correctly configured the PKCS#11 module in Acrobat's preferences, Adobe will bypass the standard macOS PIN dialog and present its own 'certificate password' field. You must enter your CAC PIN in this Adobe-specific field.
What if I am using Centrify instead of CACKey?
If you use alternative middleware like Centrify, you need to identify the exact file path to its specific PKCS#11 module on your Mac. You can then attach that custom path in Acrobat's 'Identities & Trusted Certificates' settings using the exact same method.
