Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

1

Last Updated 12/14/2022

Converting to PIV/CAC 

Authentication for OTCnet

OTCnet Connection Guide
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

2

Last Updated 12/14/2022

TABLE OF CONTENTS

Introduction.............................................................................................................................. 3

Part 1. Linking a user PIV or CAC Certificate to the User Fiscal Service SSO Account ..... 4

Part 2. Logging in to OTCnet using your PIV/CAC Credentials ............................................ 9

Part 3. Troubleshooting: If you are unable to log in to OTCnet with your PIV/CAC...........10

A. 403 Error Message When Logging in to OTCnet with a PIV/CAC..............................10

B. Validation Authority Error....................................................................................................10

C. OTCnet Server Does Not Recognize PIV/CAC Certificate...........................................11

D. Additional Troubleshooting Assistance ..........................................................................15

List of Figures

Figure 1. Select a Certificate Window...........................................................................................................4

Figure 2. Certificate Window ........................................................................................................................5

Figure 3. Certificate Enhanced Key Usage ....................................................................................................5

Figure 4. Certificate Subject Alternative Name ............................................................................................6

Figure 5. Enter PIN Window..........................................................................................................................6

Figure 6. SSO Page ........................................................................................................................................7

Figure 7. CASS Email Registration Page ........................................................................................................7

Figure 8. SSO User Log in Page......................................................................................................................8

Figure 9. Request Successfully Sent Page .....................................................................................................8

Figure 10. Fiscal Service SSO Log in Page......................................................................................................9

Figure 11. Certificates Window...................................................................................................................11

Figure 12. Certificate Export Wizard Window ............................................................................................12

Figure 13. Export Private Key in Certificate Export Wizard ........................................................................12

Figure 14. Export File Format in Certificate Export Wizard ........................................................................13

Figure 15. File to Export in Certificate Export Wizard.................................................................................13

Figure 16. File Explorer Window.................................................................................................................14

Figure 17. Complete Certificate Export Wizard Window............................................................................14

Figure 18. Export Successful Window.........................................................................................................15
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

3 

Last Updated 12/14/2022

Introduction

This document details the steps required for a user to link their Personal Identity Verification/Common 

Access Card, or PIV/CAC certificate to their Fiscal Service Single Sign-On (SSO) account and provides 

instructions for using their PIV/CAC credentials to log in to OTCnet. 

Users who do not currently have a PIV or CAC credential do not need to take action at this time. Users 

should escalate internally with their agency if the user is required to obtain a PIV or CAC credential. 

Troubleshooting—if a user is unable to log in to OTCnet with their PIV/CAC credentials, assistance 

information is available in Part 3. Troubleshooting: If you are unable to log in to OTCnet with your 

PIV/CAC

To learn more about this initiative, visit the OTCnet PIV/CAC webpage: 

https://www.fiscal.treasury.gov/otcnet/log-into-otcnet-using-your-pivcac-credentials.html. 
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

4 

Last Updated 12/14/2022

Part 1. Linking a user PIV or CAC Certificate to the 

User Fiscal Service SSO Account

• If you previously linked your PIV/CAC certificate to a Fiscal Service SSO Account, skip this section and 

proceed to Part 2. Logging in to OTCnet using your PIV/CAC Credentials. 

• You must have an active Fiscal Service SSO account for OTCnet Online to link a PIV/CAC certificate. 

• You can link a PIV/CAC certificate from any location with internet access using your agency-provided 

workstations. You do not have to be physically located at your agency. 

Follow the steps below to link your PIV or CAC credentials to your Fiscal Service SSO account.

1. Using your browser, navigate to the CASS application: https://piv.treasury.gov/cass/. 

2. A Windows Security box displays and prompts the user to select the appropriate certificate, see

Figure 1. Select a Certificate Window. You may have to select More Choices to view your other 

certificate choices. Choose the correct certificate used for authentication and enter the 

associated PIN for the credential. 

Figure 1. Select a Certificate Window

3. If multiple certificate selections are available and the user is unsure which certificate to choose, 

complete the following:

• Click the Click here to view certificate properties hyperlink. The Certificate window 

displays. 

• Click the Details tab, see Figure 2. Certificate Window. 
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

5

Last Updated 12/14/2022

Figure 2. Certificate Window

• The Details tab displays. Scroll down and select the Enhanced Key Usage option as 

shown in Figure 3. Certificate Enhanced Key Usage. Client Authentication displays within 

the lower display window when the correct certificate is selected.

Figure 3. Certificate Enhanced Key Usage

• Ensure the selected certificate includes RFC822 Name=your email address in the 

Subject Alternative Name certificate field, see Figure 4. Certificate Subject Alternative 

Name.
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

6

Last Updated 12/14/2022

Figure 4. Certificate Subject Alternative Name

4. A PIN prompt displays once the correct certificate is chosen. The user enters their Smart Card

PIN. See Figure 5. Enter PIN Window.

Figure 5. Enter PIN Window
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

7

Last Updated 12/14/2022

5. The CASS Application Home page appears in your browser. Click the I need to link my PIV or 

PIV-I cert to an existing Fiscal Service SSO account hyperlink. See Figure 6. SSO Page.

Figure 6. SSO Page

• If you receive the message “Your credential has already been linked to an SSO account. 

Your access should already be in place” your PIV/CAC credentials may already be linked 

to your SSO account due to another Fiscal Service or Treasury application.

Continue to Part 2 of this document to confirm you can use your PIV/CAC credentials to 

log in to OTCnet.

• If you receive the message “Unable to decode certificate. This is likely not an 

authentication certificate.” The certificate you selected cannot be used; this is possibly 

because it is not an authentication certificate, or it may not be a PIV, PIV-I, or CAC 

certificate. Ensure your PIV, PIV-I, or CAC is inserted into your workstation’s card reader 

and repeat steps 1 through 4, ensuring that you select a valid PIV, PIV-I or CAC 

authentication certificate (per steps 2 through 4).

6. For PIV/CAC certificates without an email address, enter your name and email address and click 

Submit, see Figure 7. CASS Email Registration Page. You will receive an email with a link to 

register. Click this link or enter it into your web browser. If your certificate has an email, CASS 

will automatically skip to the next step.

Figure 7. CASS Email Registration Page
8

7. Enter your Fiscal Service SSO UserID and Password and click Submit. See Figure 8. SSO User Log 

in Page. 

Figure 8. SSO User Log in Page

Once logged in to CASS, a message displays: “Your request has been submitted successfully”, 

see Figure 9. Request Successfully Sent Page. An email is then sent to the user email address 

associated with the Fiscal Service SSO profile. The email contains “Treasury Fiscal Service SSO 

Certificate Activation Notification” in the subject line.

Figure 9. Request Successfully Sent Page

8. Once the email is received, log in to the Fiscal Service Application using your PIV/CAC 

credentials.
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

9 

Last Updated 12/14/2022

Part 2. Logging in to OTCnet using your PIV/CAC Credentials

Once your PIV or CAC certificate is successfully linked to your Fiscal Service SSO account, log in to 

OTCnet using your PIV/CAC:

1. Use Microsoft Edge or Google Chrome to access OTCnet Production at: 

https://www.otcnet.for.fiscal.treasury.gov/otcnet/views/home.xhtml. 

See Figure 10. Fiscal Service SSO Log in Page. 

On December 10th, 2022, the OTCnet URL domain changed from fms.treas.gov to 

for.fiscal.treasury.gov. This change will not impact your current log in process. User IDs, 

Passwords, and PIV/CAC credentials will remain the same. 

On the log in screen, ensure that the yellow Log in to box contains the full URL, see red arrow in

Figure 10. Fiscal Service SSO Log in Page. 

Figure 10. Fiscal Service SSO Log in Page

a. Click the PKI Certificate hyperlink, see Figure 10. Fiscal Service SSO Log in Page. You will 

be prompted to select your PIV/CAC authentication certificate.

b. Select your PIV/CAC certificate and click OK to log in to OTCnet. You may be prompted 

to enter your PIV/CAC PIN before the log in process completes. Once successfully logged 

in, you can use your PIV/CAC credentials to log in to OTCnet in the future. The process is 

complete and no additional steps are required. 

If you receive an error while attempting to log in with your PIV/CAC, continue with Part 3. 

Troubleshooting: If you are unable to log in to OTCnet with your PIV/CAC. 
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

10

Last Updated 12/14/2022

Part 3. Troubleshooting: If you are unable to log in to 

OTCnet with your PIV/CAC

A. 403 Error Message When Logging in to OTCnet with a 

PIV/CAC 

If you receive the message, “The website declined to show this webpage / HTTP 403” or “Forbidden / 

You are not authorized to access the requested resource”, follow the steps below:

1. In the browser address bar, delete all the characters after “home.xhtml”. 

You should see the characters %3E%3Cbody%20bgcolor= or ><body%20bgcolor=. Delete these 

characters from the address bar and press the Enter key on your keyboard. 

2. You should now see the OTCnet home page. If you see the log in screen instead, your session 

has timed out; click the PKI Certificate hyperlink and log in using your PIV/CAC credentials again

and you should see the OTCnet home page.

3. Bookmark the URL https://www.otcnet.for.fiscal.treasury.gov/otcnet/views/home.xhtml and 

use this URL for future OTCnet log in. 

B. Validation Authority Error 

If you receive a “Validation Authority” error or other errors related to your certificate when attempting 

to log in to OTCnet using your PIV/CAC credentials, follow the steps below: 

Note: The steps below only apply to validation errors and authentication errors relating to certificates.

1. Take a screenshot of the certificate error when attempting to log in to OTCnet with your 

PIV/CAC credentials. 

2. Email FiscalService.OTCChannel@citi.com and provide a description of your workflow with the 

screenshot from the previous step. The OTC Support Center Team will address your inquiry. 

They can also be reached by phone at 866-945-7920. 
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

11

Last Updated 12/14/2022

C. OTCnet Server Does Not Recognize PIV/CAC Certificate

If you receive a “Validation Authority” error or an error was caused by the OTCnet server not 

recognizing your PIV/CAC certificate issuer, your PIV/CAC certificate’s issuer may not yet be supported 

by the Treasury Web Applications Infrastructure (TWAI) for authentication. 

To determine if this is the case, email your public PIV or CAC certificate to

FiscalService.OTCChannel@citi.com. To do this, locate and export your public end-entity authentication 

certificate by completing the following steps:

1. With your CAC/PIV card inserted in your workstation, type Internet Options in the Windows 

search bar. 

2. Select and launch the Internet Options application. 

3. Click the Content tab at the top of the Internet Properties application. 

4. Click the Certificates button. 

5. Under the Personal tab on the Certificates screen, see the Issued To column and look for your 

name or Government ID. 

6. Select the item with your name or Government ID, the Authentication Certificate may appear 

under the Friendly Name column. See Figure 11. Certificates Window. 

7. Click Export, see Figure 11. Certificates Window. 

Figure 11. Certificates Window
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

12

Last Updated 12/14/2022

8. The Certificate Export Wizard Start dialog box displays. Click Next >, see Figure 12. Certificate 

Export Wizard Window.

9. The Export Private Key dialog box displays. Select the No, do not export the private key button

and click Next >, see Figure 13. Export Private Key in Certificate Export Wizard.

Figure 12. Certificate Export Wizard Window

Figure 13. Export Private Key in Certificate Export Wizard
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

13

Last Updated 12/14/2022

10. The Export File Format dialog box displays. Select the Base-64 encoded X.509 (.CER) button. 

Click Next >, see Figure 14. Export File Format in Certificate Export Wizard.

11. The File to Export dialog box displays. Click Browse, see Figure 15. File to Export in Certificate 

Export Wizard.

Figure 14. Export File Format in Certificate Export Wizard

Figure 15. File to Export in Certificate Export Wizard
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

14

Last Updated 12/14/2022

12. Navigate to a folder you want to export your certificate file and type in your desired file name. 

Click Save, see Figure 16. File Explorer Window. On the File to Export screen click Next.

13. A confirmation screen displays. Click Finish, see Figure 17. Complete Certificate Export Wizard 

Window.

Figure 16. File Explorer Window

Figure 17. Complete Certificate Export Wizard Window
Converting to PIV/CAC Authentication for OTCnet Bureau of the Fiscal Service

15

Last Updated 12/14/2022

14. A confirmation dialog box displays. Click OK, see Figure 18. Export Successful Window. 

15. Navigate to the folder where you saved the file and rename the file extension of the file to .txt. 

Confirm that you want to change the file name extension and click Yes to confirm. If using the 

example above, the exported file is called EndEntityCert.cer, and it should be renamed to 

EndEntityCert.txt

16. Email FiscalService.OTCChannel@citi.com and attach a screenshot of the EndEntityCert.txt file. 

Note that this is a public certificate and it does not contain a private key.

Once the OTC Support Center Team receives the text file, the information will be provided to 

TWAI. TWAI will determine if your certificate’s issuer is supported, or if there is another issue 

with the certificate preventing PIV/CAC authentication.

D. Additional Troubleshooting Assistance 

For additional troubleshooting assistance, visit the Fiscal Service Guide to Linking Fiscal Service SSO 

UserID to a SmartCard: https://www.fiscal.treasury.gov/files/reference-guidance/linking-fiscal-servicesso-piv-cac-guide.pdf. 

Thank you for converting to PIV/CAC for your authentication to OTCnet! 

Figure 18. Export Successful Window