pre-introduction

On 22 March 2020, I started tracking how many visitors have come to this page.

From 22 March 2020 to 03 Jan 2022 (20 months), this site has had:

On 14 Jan 2023, just one year later, those total numbers have tripled!!

The site total monthly users averages near 1500 per month...up from 150 per month when this first started!

I've gotten e-mails from the DHA Global Service Center, an AVHE Senior Engineer, and the Congressional Medical Clinic. What a wild ride.

Anyway...on to the instructions!

Jacob

introduction | mac & pc

This page was created to help users access AVHE medical applications from home.

I know it can get technical and a bit wordy, but please try to follow these instructions in order and do specifically what they ask you to do.

Each blue section header is labeled with Mac and PC so you know if the section applies to your platform.

If you find yourself stuck, send me an e-mail. My contact information is in the Outlook Global. I'm the only Lt Col Jacob Wessler in there.

Please include a screenshot of your current error. (Mac Screenshot Instructions | PC Screenshot Instructions)

Good luck!!
Jacob

jump to section

mac or pc | mac & pctop

This is a great place to start.

You can get AVHE and the DHA Clinical Desktop working on any modern macOS or Windows machine. Some take a little more work than others but you can have success with either.

So, you can do it with just about any computer.

Except Chromebooks. NEVER Chromebook. You can't get a good CAC reader for Chromebooks. Many have tried. They have all failed!

So, I advise people to stick with what they have. You can get it to work. I believe in you.

what CAC reader should I get? | mac & pctop

Get one of these two CAC readers. (click the links to shop at Amazon. These are NOT affiliate links. I don't make any money from you clicking them.)

SCR3310 USB reader
SCR3310 USB reader
SCR3500 USB reader
SCR3500 USB reader

PC USERS - Some folks still have success with the SCR331. But, you'd be safer buying a new one.
MAC USERS - Stay away from the SCR331. It's pretty old and doesn't play well with macOS.
It looks like this:

SCR3500 USB reader
SCR331 USB reader

gatekeeper and installing software | mactop

Apple has a safety feature called Gatekeeper. This program prevents you from installing potentially dangerous software. There are a lot of caveats to how this system works but it can hinder software installation. In order to install certain programs (like the CAC enabler software and CITRIX Workspace App), you may need to disable Gatekeeper.

Go to this article from Apple to learn how to disable Gatekeeper or bypass it for one application. If you disable it, please re-enable it after installing CITRIX.

It's safer that way.

enable your CAC reader | mactop

Before we talk about CAC enablers, we need to know which version of macOS you are running.

To find your operating system, click the Apple icon in the top left corner of your screen and select "About this Mac." The pop-up will tell you what version is installed (ex: Version 10.13.6).

macOS Version

If you have macOS 10.15 or later, read subsection 1. If you have 10.14 or earlier, read subsection 2.

subsection 1 - macOS 10.15 and later

For macOS 10.15 (Catalina) and later, you CANNOT install a CAC enabler. The operating system has built-in software to read your CAC. You will still need to install the DoD Certificates and CITRIX, though.

1) If your computer is BRAND NEW with macOS 10.15 or later and you have never installed a CAC enabler on it - DON'T INSTALL ONE. You can skip ahead.

2) If your computer is older and you upgraded to 10.15 (or later), you may need to remove any old CAC enablers and re-enable SmartCard services (if you disabled it).

Go to this article from MilitaryCAC.com and follow the instructions to remove any old CAC enablers you may have installed on your computer. (If you bought a brand new computer with macOS 10.15 installed, you can skip this step.)

If you have previously disabled the included SmartCard services in macOS 10.13 Sierra or later, you will need to re-enable those services. Those instructions are at the very bottom of this page in NOTE3.

subsection 2 - macOS 10.14 and earlier

For macOS 10.14 or EARLIER (Mojave, High Sierra, Sierra, etc), you will need to install a CAC enabler. If you have macOS 10.15 (Catalina) installed READ THE PART ABOVE FOR macOS 10.15!!!

Now that you have a CAC reader, you have to install some software to make it work with your Mac.

To choose the right software, we need to know if you have a Gemalto or an Oberthur CAC. Look on the back at the top of the card. There is a small strip of numbers and words. Look for the word Gemalto or Oberthur.

Go to this site and find the right CAC enabler for your CAC type and your Mac operating system.

I start with CACKey. I have had good success with it and use it first. It's free so that's a big selling point!

PKard is another good option (and has its apostles) but you have to buy the software (~$40). I have had success with CACKey for the past 8 years. You can likely get away without having to pay for PKard, but it is available as a last resort.

Note: You may need to disable gatekeeper to install the software.

Now we need to make sure your CAC reader is working. Plug your reader into your computer, put your CAC in the reader, and open Keychain Access. (Click the magnifying glass in the top right of your screen and type in Keychain. Select Keychain Access)

Above the login item in the top left corner should be your name or PIV_II or something similar (depending on your CAC).

Click ONCE on that listing (you cannot unlock your CAC card...nor do you need to) - if you can see a bunch of certificates on the right side of the window, some with your name and some without, then you were successful. If not, go back and download a different enabler. Make sure that enabler works with your CAC and macOS version.

dod certificates | mac & pctop

This has become one of the biggest hurdles for new users to get over.

Make sure you follow these instructions closely. If you have already installed the DoD Certificates and you are getting SSL or connection errors, please install the certificates again using these links and these instructions.

These DoD certificates are DIFFERENT than the certificates on your CAC. You need to have the right DoD certificates installed on your computer in order for your computer to talk to the DoD servers.

The DOD updates their certificates every now and then and you need to make sure that you have the most current certificates installed and trusted on your computer.

mac Users

Download the AllCerts.zip file.

Go to your Downloads folder and find the AllCerts.zip file.

If it hasn't expanded to a folder, double-click it. I already double-clicked mine so you can see what the folder looks like.

Double-click the folder to open it and see all the certs

Press Command-A to select all the certs in the folder. Then press Command-O (that's an "o" not a zero) to open them all.

You will see a dialog box asking if you want to import the certificate. Make sure that "login" is selected in the drop-down box. Click Add for each certificate (there are a lot of them).

trust those dod root ca certificates

HOLY COW - DO NOT SKIP THIS PART! SERIOUSLY, THIS IS 90% OF THE ERRORS PEOPLE E-MAIL ME ABOUT!!

Open Keychain Access (click the magnifying glass in the top right of your screen and type in Keychain. Press Enter when Keychain Access appears.)

Scroll down until you find the DoD Root CA certificates. Most likely, yours will have red xs by them.

Select all of the ones with red xs (Hold down Control while you click them individually) then press Command-I (that's an "i") to edit them.

In the window that opens, click the gray triangle next to Trust. Select Always Trust from the first drop-down box.

Click the red circle in the top left corner to close the window. Enter your computer password to accept the change.

Do this for all the DoD Root CA certs until they have blue plusses next to them.

You are now done with the DoD Certificates part of the installation. You may continue on with the CITRIX instructions.

pc users

YOU TOO! THIS IS A VERY IMPORTANT STEP! DON'T SKIP IT!

You need to install the DoD Certificates for your computer. There is a program that will do this for you. It is called InstallRoot.

Go to this page at MilitaryCAC.com and scroll down to the section on InstallRoot (it's a small scroll).

Download the MilitaryCAC (.msi version) to your computer. Find the file. Double-click on it to run it.

Follow the prompts to install the DoD Certificates.

download CITRIX | mac & pctop

Moving along now.

We need to download the CITRIX software to talk to the AVHE servers. Because the software is changing so often, I will direct you to the CITRIX site to download the latest software.

Click here to go to the CITRIX downloads page.

Once there, click on the "Select Product..." drop-down and select "CITRIX Workspace App" from the list. On the next page, select "Workspace App for Mac" or "Workspace App for PC" from the list. (One user had to download the Workspace App Universal version on PC)

Download the newest version of CITRIX Workspace App and install it.

Note: You may need to disable gatekeeper to install the software.

citrix add an account dialog box

After installing the CITRIX Workspace App, you may get a dialog box asking you to "Add Account."

IGNORE this dialog box. Just click cancel and close the app. When you go to AVHE, the plugin will automatically load. You don't need to do anything with this dialog box. Your DoD e-mail account won't work so don't even bother trying it!

which browser should I use | mac & pctop

mac users

I recommend using Google Chrome to access AVHE. It just works better.

Chrome is not available in the Mac App Store. You can download it here.

When trying to connect to the AVHE site, you may get an error page stating that your connection is not private. If so, see the Google Chrome Bug troubleshooting tips.

pc users

Most PC users have done okay with Google Chrome but I have seen more and more people need to use Microsoft Edge.

If you are having trouble using Google Chrome, consider trying Microsoft Edge instead.

AVHE | mac & pctop

AVHE stands for Application Virtual Hosting Environment and is used to connect to clinical applications. This means AHLTA, CHCS, Essentris, and MHS GENESIS.

This system uses the CITRIX Workspace App to run applications on your desktop.

You already installed CITRIX, right?

RIGHT?!

Okay...good.

new AVHE user | mac & pc

If this is your FIRST time EVER using AVHE, you need to contact the Global Service Center (GSC) and have them create your account.

Send an e-mail to [email protected] and ask them to create an AVHE account for you.

It is best if you can send this from your @health.mil e-mail account but you don't have to.

Tell them that you need access to AHLTA, CHCS, and ESSENTRIS (or MHS GENESIS) in your e-mail because they will likely ask.

If you've used AVHE at a previous command or you have the e-mail from the Global Service Center telling you your account is created, then you can continue.

You can connect to AVHE using this link: https://avhe.health.mil

You will be presented with a drop-down asking you to select your CAC certificate.

DOD E-mail certificate selection

Select your PIV certificate (DOD ID CA-XX; the numbers may be different for your CAC. That's okay.)

Mac users will be presented with a dialog box asking for Keychain access. This is asking for your CAC PIN. Do not enter your computer password here. It is your 6-8 number CAC PIN.
PC users will be presented with a dialog box that looks like the one at work. Make sure you select your authentication certificate.

CAC Password

If things are going well, and this is your first time on AVHE, then you should see a Detect Receiver page.

AVHE detect receiver

Click the Detect Receiver button there in the middle. It's the blue one. Don't be shy!

Next, you'll see a window pop-up asking if you want to Open the Citrix Workspace Launcher.

Looking good

Click Cancel.

Then click Already installed.

If you see a blue screen with CITRIX Receiver on it...things are looking good!

Looking good

Next you should see the DoD Consent banner. Go ahead and click Accept.

AVHE DOD Consent Banner

If everything worked out, you should see a page with two shortcuts: AVHE Support and DHAGSC Remedy Phone number (This is the DHA Global Service Center (GSC) Helpdesk phone number).

This is your Favorites tab. You can see Favorites at the top middle of the page.

My page has Favorite apps already added in.

AVHE Favorites

Next to Favorites is the Apps tab. Click on Apps to find your site-specific application shortcuts.

Type your MTF in the search box to filter the apps.

The site knows which AHLTA application to give you based on your MTF. The name may not match. For example, Langley users will see the Portsmouth AHLTA app when they type in Langley. That's because Langley AFB is on the same CHCS/AHLTA host as Portsmouth.

AVHE Apps search page

Click the Details button of the app you want to use or save.

AHLTA App details

Click the "Add to Favorites" button to add this app to your Favorites tab.

Click the Open button to launch the app.

Click around. Have fun. You have just successfully set up AVHE at home.

mhs genesis | mac & pctop

You can access MHS GENESIS three ways while you are away from your facility

  1. Access directly: https://access.mhsgenesis.health.mil
  2. Access using the app in AVHE: https://avhe.health.mil (see instructions above titled avhe)
  3. Access from the Clinical Desktop (see instructions below titled connect to DHA Desktop)

Option 1 will be the fastest and is my recommended (and favorite) way. Pay attention to your screen resolution and any scaling you may have turned on in your display settings as that may affect how well this option works. (I'm still figuring out the nuances here and do not have any guidance on the best settings)

Option 2 essentially opens a VPN tunnel to the link in Option 1. So, you are creating a nested VPN situation. This will slow things down a bit for you.

Option 3 is similar to Option 2 and is just as slow.

connect to DHA Desktop | mac & pctop

You should see a DESKTOPS button at the top of your AVHE page. Click that button and you'll go to the DHA Desktop page.

DHA Desktop

From there, click on the DHA Desktop - [YOUR MTF HERE]. Click on the Desktop for the MTF you are accessing.

This Desktop will allow you to work on a desktop that looks just like your desktop at work. You can access all network applications (e.g. Synapse) and network shares (like your H: drive or any department/division drives). Since you're using regular Microsoft Outlook, you CAN send and receive encrypted e-mail.

connect to webmail | mac & pctop

To the Anonymous AVHE Engineer who sent me feedback on 05 Jan 2023 - what I mean is that you cannot access webmail from your personal device on your personal network at home. If you still feel this is wrong, please reach out to Lt Col Jacob Wessler. I'm the only one in the Global. I'd love to find out what I am doing wrong!

AS OF AUGUST 2022 - DHA has removed home access for webmail for users with the @health.mil e-mail addresses.

Basically, that's all of us!

You MUST use the Clinical Desktop to access your e-mail.

If you are at work on a .mil network, you can access webmail via https://webmail.apps.mil...but if you're at work, you might as well use Outlook!

troubleshooting | mac & pctop

There are a lot of things that can go wrong with the above process. Software will change frequently and the system can often get confused.

If you find that your system WAS working but now is NOT, think about anything that might have changed.

Did you:

Any one of these might change your system.

The first step is to troubleshoot your CAC/reader combination. Try logging on to DTS or MyPay. If you can get in there, your problem is with AVHE. If you can't get in there, then the problem is with your CAC/reader combination. Reinstall your CAC enabler to see if that fixes things. (DO NOT reinstall/install a CAC enabler if you are on macOS 10.15 Catalina or later)

webmail doesn't work | mac & pc

Yeah. This one's a bummer.

The new @health.mil e-mail addresses don't have webmail you can access from home. You have to log on to the DHA Desktop to check your e-mail.

If you are on the .mil network, you can get to webmail through https://webmail.apps.mil but this will not work on your home device.

update your DoD certificates | mac & pc

Every now and then the DoD updates their certificates. Installing the new certificates can fix a lot of problems and is a good first step.

I get burned by this every now and then...makes me feel pretty stupid when I finally figure it out!

PC users should follow these instructions.

Mac users should go to the DoD Certificates section of this website and follow those instructions.

clear your keychain | mac

Sometimes, your computer gets confused with which CAC certificate it should present to the server. The easiest way to fix this problem is to delete the keychain preference. You should do this if you notice that you are having trouble logging on when things were working before and you didn't change any of the above things.

Open Keychain

Find any reference to web.mail, web-mail, or AVHE. Click on those entries and delete them.

Keychain clear

Go back to WebMail or AVHE and try logging in again.

Remember to use your DOD ID CA-XX certificate.

Google Chrome bug | mac & pc

Some users report getting stuck on Google Chrome with a "Your connection is not private" error. It looks like this:

Google Chrome bug

If you can get into myPay, DFAS, NKO, etc and you still get this error in Google Chrome follow these steps:

  • Load https://avhe.health.mil and wait for the error message
  • MAKE SURE YOU ARE ON THE RIGHT WEBPAGE!! Following the steps below on the WRONG website could lead to a virus on your computer.
  • Click somewhere on the white part of the web page ONCE with the left mouse button
  • Type in "thisisunsafe" (without the quotes, all lowercase, no spaces)
  • Seriously, type "thisisunsafe" and then the page should load
  • If the page doesn't load then this is not your error and something else is going on. Consider reinstalling your certificates.

client auth error | mac & pc

Sometimes, after trying to connect multiple times from one browser session, you might get the following error page when going to the AVHE site.

This happens to me every now and then. I think your computer gets confused with the multiple connection attempts and just gives up.

The way I have found to fix this is to QUIT your browser. Don't just close your current window. Actually quit the program.

Mac Users - Click the name of your browser in the top left corner of your screen. Select Quit [browser name]. (e.g. Quit Google Chrome or Quit Safari)
PC Users - Click the red x in the top right corner of your browser window. If you are prompted, click the "Close all tabs" button.

UNPLUG YOUR CAC READER FROM YOUR COMPUTER!! Yes, take the whole thing out. Unplug it.

Take your CAC out of your CAC reader.

Plug your reader back into your computer and place your CAC back in the reader.

Restart your browser and give it another shot. You may need to wait 5-10 seconds for everything to settle in before you launch the AVHE website.

white screen of death | mac & pc (I think)

Some people have been getting the White Screen of DEATH!

Basically, the web page just shows you a white screen in Chrome. I have only seen this in Macs but it makes sense that it might happen in Windows as well.

If you can access DoD Webmail or myPay without trouble then you know your CAC -> CAC Reader -> Computer connection is working.

If you are getting the White Screen of DEATH then right click on the white page and select "View Source."

A new Chrome window will pop up with some webpage code in it.

AVHE Not Allowed

If you see the text "You are not allowed to login" then you need to contact the Global Service Center at [email protected] and tell them that you either 1) need a new AVHE account (because it's your first time using it) or 2) need them to reset your account because it is corrupted.

Once they create/reset the account, you can go back to https://avhe.health.mil and try it again.

pc certificate error | pc

PC users may see an error about the SSL certs not existing or being trusted or working.

If that happens, you need to install the DoD Certificates and run the FBCA Cross-Certificate Removal Tool.

REMOVE YOUR CAC FROM YOUR READER BEFORE ATTEMPTING THE THREE STEPS BELOW!

1. Go to this page at MilitaryCAC.com and scroll down to the section on InstallRoot (it's a small scroll).

Download the MilitaryCAC (.msi version) to your computer. Find the file. Double-click on it to run it.

Follow the prompts to install the DoD Certificates.

2. NEXT, you should run the FBCA Cross-Certificate Removal tool. This helps to clear up any certificate issues on your computer.

Go to this page and download the FBCA Cross-Certificate Remover tool. Run the program and follow the prompts.

3. Restart your computer and try again. You should be good to go.

thankstop

I hope you found this useful. If you have any comments or critiques, please send me an e-mail. I'm in the global.

Jacob Wessler
Lt Col, USAF

versionstop

I'll keep a running list of version changes here so you can come back and see what has changed if you find you are having problems.

version 3.7uploaded 15 JAN 23

Added section on MHS GENESIS

version 3.6uploaded 03 OCT 22

Updated section on webmail
Changed @mail.mil addresses to @health.mil
General cleanup of some language
Version 3.6 Archive

version 3.5uploaded 14 AUG 22

Updated Introduction Stats
Added info on webmail changes with @health.mil e-mail addresses
Version 3.5 Archive

version 3.4uploaded 11 JAN 22

Updated Introduction
Added Update DoD Certificates Troubleshooting section
Version 3.4 Archive

version 3.3uploaded 17 JAN 21

PC SSl troubleshooting section added - FBCA Cross-Cert Removal Tool, Install Root
Version 3.3 Archive

version 3.2uploaded 08 DEC 20

Added opening section on Mac vs PC. Also NEVER Chromebook.
Version 3.2 Archive

version 3.1uploaded 24 APR 20

Added comment to CITRIX Workspace App for PC users
Added info for new AVHE users
Added screenshots of the Detect Receiver process for AVHE
Added Troubleshooting section on the White Screen of DEATH
Added "Jump to the top" links for all major blue sections
Version 3.1 Archive

version 3.0uploaded 09 APR 20

Added section on Gatekeeper and linked to it from other sections
Expanded section on DoD Certificates
Updated section on browsers
Added section on Microsoft Edge (pc only)
Added troubleshooting section on the client_auth_signature_failed error
Version 3.0 Archive

version 2.3uploaded 01 APR 20

Added section on Chrome vs. Safari (mac only)
Added screenshot of CITRIX Add Account and why we skip it
Added link to FBCA Cross Certificate Removal tool
Version 2.3 Archive

version 2.2uploaded 31 MAR 20

It's Catalina, not Cantalina...apparently! FIXED 5 errors.
New introduction with instructions for taking a screenshot
New Table of Contents
Refreshed CAC Enabler, CITRIX, and DoD Certificate sections
Google Chrome bug information added
Google Chrome bug screenshot added (Thanks MJD!!)
Version 2.2 Archive

version 2.1uploaded 21 MAR 20

Updated Table of Contents
Clarified CITRIX Workspace app vs CITRIX Receiver
Added info on the DHA Desktop
Expanded Troubleshooting section
Fixed spelling errors and one more CAC tautology (CRIMENY!)
Version 2.1 Archive

version 2.0uploaded 21 FEB 20

Refresh of all instructions
Reduced information as the process is simpler now
Added info on macOS 10.15 Catalina and later
Added DOD Certificates in Troubleshooting
Version 2.0 Archive

version 1.1uploaded 08 AUG 18

Updated URL
Updated screenshots
Added screenshots for Favorites
Fixed all instances of the "CAC card" tautology (Ugh...)
Version 1.1 Archive

version 1.0uploaded 20 OCT 15

Website created
Version 1.0 Archive