Using Government Access Cards with Game Warden
Overview of government-issued access cards (CAC, ECA, PIV), when to use them, and how certificate policies work for Game Warden access.
Use this guide to learn about government-issued access cards and when Game Warden requires them.
Once you have obtained a government access card, refer to Link Access Card with Platform One (P1) Account for instructions on associating your card with your P1 account for future authentication to Game Warden.
What are government access cards
Government-issued access cards are secure credentials that use certificate-based authentication to verify a user's identity when accessing government systems and environments. These cards embed cryptographic certificates that support Private Key Infrastructure (PKI) standards for secure access.
Game Warden supports the following types of government-issued access cards:
Issued by the U.S. Department of War (DOW) to military personnel, government employees, and eligible contractors.
Process to acquire CAC
To obtain a CAC, you must go through the DOW vetting process with the support of a government sponsor. This process can take several months to complete.
The DOW issues CACs to eligible individuals, including:
- Active-duty military personnel
- Reservists
- Federal civilian employees
- Authorized contractors
Acquisition process:
You must work directly with your government sponsor to complete the following steps:
- Sponsorship and Eligibility Verification
- Registration and Enrollment
- Background Investigation
- Card Issuance
For detailed guidance, see the Process for Acquiring or Renewing a CAC or refer to the General Information section.
You may receive a CAC based on fingerprint results; however, final approval depends on passing the National Agency Check with Inquiries (NACI). If the background check is not approved, the CAC will be revoked.
Issued by the U.S. Department of War (DOW) to military personnel, government employees, and eligible contractors.
Process to acquire CAC
To obtain a CAC, you must go through the DOW vetting process with the support of a government sponsor. This process can take several months to complete.
The DOW issues CACs to eligible individuals, including:
- Active-duty military personnel
- Reservists
- Federal civilian employees
- Authorized contractors
Acquisition process:
You must work directly with your government sponsor to complete the following steps:
- Sponsorship and Eligibility Verification
- Registration and Enrollment
- Background Investigation
- Card Issuance
For detailed guidance, see the Process for Acquiring or Renewing a CAC or refer to the General Information section.
You may receive a CAC based on fingerprint results; however, final approval depends on passing the National Agency Check with Inquiries (NACI). If the background check is not approved, the CAC will be revoked.
Issued by DOW-approved commercial vendors to contractors and vendors who work with DOW systems but are not eligible for CACs.
Process to acquire ECA
The ECA program provides digital certificates to eligible individuals affiliated with companies that require access to DOW systems. ECAs serve as an alternative to CACs for contractors and partners who are not eligible for a CAC.
To obtain an ECA certificate, you must complete the DOW vetting process through a DOW-approved vendor such as IdenTrust or WidePoint. The typical processing time is approximately 30 days.
Acquisition process with IdenTrust:
- Complete the required forms and have them notarized. You must submit your notarized forms within 30 calendar days of notarization — late submissions are invalid.
- Submit your application and documentation to the vendor within 30 days of notarization.
- Undergo identity verification by the vendor (typically 3–5 business days).
- Receive your certificate by mail based on the delivery option you select.
For compatibility recommendations and important usage notes, see the ECA Certificate Compatibility Guide.
- Game Warden recommends using IdenTrust, a DOW-approved provider, for obtaining ECA certificates.
- For best compatibility with Game Warden's Keycloak Single Sign-On (SSO), we recommend selecting the ECA Medium Token Assurance option from IdenTrust. This token type has been validated to work with Game Warden's identity and access management system.
- Game Warden is not affiliated with IdenTrust. Please contact IdenTrust directly for questions regarding certificate issuance or support.
- Known compatibility considerations:
- Mac users with M1 chips must use Firefox when accessing government systems with an IdenTrust ECA. IdenTrust is aware of this limitation and is working to address it.
- Linux/Ubuntu is not supported for retrieving digital certificates from IdenTrust.
- Recommended browsers for certificate setup:
- Windows: MS Edge or Google Chrome (latest versions)
- Mac: Mozilla Firefox (latest version)
For complete system requirements and supported configurations, refer to the IdenTrust Certificate Compatibility Guide.
Issued by U.S. federal agencies for access to federal systems.
Process to acquire PIV
Federal agencies issue PIV cards to eligible individuals to provide secure access to government systems. To obtain:
- Work directly with your government sponsor to request and complete the PIV issuance process.
- Confirm that your PIV card is issued with the required certificate policies to enable access to IL4+ environments via Platform One SSO.
- Coordinate with the Game Warden team to verify your access after issuance.
- Game Warden does not issue or manage government access cards. You must obtain them directly from a government sponsor or a DOW-approved provider.
- Users with a CAC, ECA, or PIV can access Game Warden environments at IL2, IL4, and IL5 through Platform One (P1) Single Sign-On (SSO) — provided their access card includes one of the required certificate policies.
- Contact the 2F Platform team for proactive guidance before attempting access. We can assist with validating your card's configuration and ensuring it works with IL2, IL4, and IL5 environments.
Government access card comparison
The table below summarizes key requirements and acquisition processes for each supported government access card.
- Government sponsors issue CAC and PIV cards.
- Obtain ECA certificates from a DOW-approved vendor, such as IdenTrust, Inc.
| Card Type | Estimated Wait Time | U.S. Citizenship Requirement | Cost |
|---|---|---|---|
| CAC | Up to 18 months (based on background investigation) | Not required | Consult with your government sponsor |
| ECA | ~30 days after submitting notarized forms | Not required | View IdenTrust pricing - prices may vary for non-U.S. citizens |
| PIV | 2-6 weeks | Must be a U.S. National† | Consult with your government sponsor |
† U.S. National: An individual who owes permanent allegiance to the United States. This includes U.S. citizens and certain non-citizens, such as individuals born in American Samoa or Guam.
When is a government access card required
Impact Level (IL) requirements and access control policies govern access to Game Warden-hosted applications. A government-issued access card is required for certain environments and strongly recommended for others, depending on the deployment stage and access method.
Use the following table to determine when you need a government access card.
| Resource | Requires Government Access Card |
|---|---|
| Customer Application at IL2 STG | No |
| Customer Application at IL2 PRD | No |
| Customer Application at IL4 | Yes |
| Customer Application at IL5 | Yes |
| Game Warden Application at IL2 | No |
| Game Warden Application at IL5 | Yes |
| Harbor Registry at IL2 | No |
| Harbor Registry at IL5 | Yes |
| ArgoCD at IL2 | No |
| ArgoCD at IL4 | Yes |
| ArgoCD at IL5 | Yes |
| Grafana at IL2 | No |
| Grafana at IL4 | Yes |
| Grafana at IL5 | Yes |
Certificate policies and Public Key Infrastructure (PKI)
PKI is a security framework used to issue and manage digital certificates for secure authentication, encryption, and digital signatures. In government systems, PKI authenticates users with trusted, cryptographically validated credentials before they access sensitive environments such as Game Warden at IL4 and IL5.
PKI works by using a pair of cryptographic keys (public and private) linked to a user's identity, managed through a Certificate Authority (CA). A digital certificate contains these keys, which users present when authenticating to a system.
PKI is a security framework used to issue and manage digital certificates for secure authentication, encryption, and digital signatures. In government systems, PKI authenticates users with trusted, cryptographically validated credentials before they access sensitive environments such as Game Warden at IL4 and IL5.
PKI works by using a pair of cryptographic keys (public and private) linked to a user's identity, managed through a Certificate Authority (CA). A digital certificate contains these keys, which users present when authenticating to a system.
A certificate policy defines the rules that govern how applications and systems use a digital certificate and the level of assurance it provides.
Object Identifiers (OIDs) uniquely identify certificate policies. Systems such as P1 and Game Warden verify both the certificate and its associated policy before granting access.
These policies allow relying parties to enforce usage restrictions and ensure compliance with security standards.
These Game Warden-approved certificate policies are grouped by issuing program. Each group lists the Object Identifier (OID) and policy identifier.
DOW certificate policies (person and hardware certificates)
| Certificate Policy OID | Policy Identifier |
|---|---|
2.16.840.1.101.2.1.11.5 | id-US-dod-medium |
2.16.840.1.101.2.1.11.9 | id-US-dod-mediumhardware |
2.16.840.1.101.2.1.11.10 | id-US-dod-PIV-Auth |
2.16.840.1.101.2.1.11.18 | id-US-dod-medium-2048 |
2.16.840.1.101.2.1.11.19 | id-US-dod-mediumHardware-2048 |
2.16.840.1.101.2.1.11.20 | id-US-dod-PIV-Auth-2048 |
2.16.840.1.101.2.1.11.31 | id-US-dod-peerInterop |
2.16.840.1.101.2.1.11.39 | id-US-dod-medium-112 |
2.16.840.1.101.2.1.11.40 | id-US-dod-medium-128 |
2.16.840.1.101.2.1.11.41 | id-US-dod-medium-192 |
2.16.840.1.101.2.1.11.42 | id-US-dod-mediumHardware-112 |
2.16.840.1.101.2.1.11.43 | id-US-dod-mediumHardware-128 |
2.16.840.1.101.2.1.11.44 | id-US-dod-mediumHardware-192 |
2.16.840.1.101.2.1.11.59 | id-US-dod-admin |
DOW certificate policies (non-person entity certificates)
| Certificate Policy OID | Policy Identifier |
|---|---|
2.16.840.1.101.2.1.11.17 | id-US-dod-mediumNPE |
2.16.840.1.101.2.1.11.36 | id-US-dod-mediumNPE-112 |
2.16.840.1.101.2.1.11.37 | id-US-dod-mediumNPE-128 |
2.16.840.1.101.2.1.11.38 | id-US-dod-mediumNPE-192 |
2.16.840.1.101.2.1.11.60 | id-US-dod-internalNPE-112 |
2.16.840.1.101.2.1.11.61 | id-US-dod-internalNPE-128 |
2.16.840.1.101.2.1.11.62 | id-US-dod-internalNPE-192 |
ECA certificate policies
| Certificate Policy OID | Policy Identifier |
|---|---|
2.16.840.1.101.3.2.1.12.1 | id-eca-medium |
2.16.840.1.101.3.2.1.12.2 | id-eca-medium-hardware |
2.16.840.1.101.3.2.1.12.3 | id-eca-medium-token |
2.16.840.1.101.3.2.1.12.4 | id-eca-medium-sha256 |
2.16.840.1.101.3.2.1.12.5 | id-eca-medium-token-sha256 |
2.16.840.1.101.3.2.1.12.6 | id-eca-medium-hardware-pivi |
2.16.840.1.101.3.2.1.12.8 | id-eca-contentsigning-pivi |
2.16.840.1.101.3.2.1.12.9 | id-eca-medium-device-sha256 |
2.16.840.1.101.3.2.1.12.10 | id-eca-medium-hardware-sha256 |
Federal PKI (FPKI) certificate policies
| Certificate Policy OID | Policy Identifier |
|---|---|
2.16.840.1.101.3.2.1.3.4 | id-fpki-certpcy-highAssurance |
2.16.840.1.101.3.2.1.3.7 | id-fpki-common-hardware |
2.16.840.1.101.3.2.1.3.12 | id-fpki-certpcy-mediumHardware |
2.16.840.1.101.3.2.1.3.13 | id-fpki-common-authentication |
2.16.840.1.101.3.2.1.3.16 | id-fpki-common-High |
2.16.840.1.101.3.2.1.3.18 | id-fpki-certpcy-pivi-hardware |
2.16.840.1.101.3.2.1.3.20 | id-fpki-certpcy-pivi-contentSigning |
2.16.840.1.101.3.2.1.3.24 | id-fpki-SHA1-hardware |
2.16.840.1.101.3.2.1.3.36 | id-fpki-common-devicesHardware |
2.16.840.1.101.3.2.1.3.38 | id-fpki-certpcy-mediumDeviceHardware |
2.16.840.1.101.3.2.1.3.39 | id-fpki-common-pivi-contentSigning |
FAQs
Will it affect my app's deployment to IL4+ environments if I don't have a government access card?
Game Warden can deploy your application to IL4+ staging (STG) and production (PRD) environments even if you do not have a government access card (CAC, PIV, or ECA). However, you will not be able to access your environment, logs, or application endpoints without an approved government access card.
Can I hire a service member with a government access card to perform DevSecOps work for my company?
No. Hiring a Reservist or National Guard member to use their government access card for company work is strictly prohibited. This constitutes misuse of government credentials and can result in serious consequences for the service member.