ActivClient Agent is used to issue certificates to NSS tokens on SIPR.

• A. True
• B. False
• C. Not applicable
• D. Both

Answer: (B)

ActivClient Agent is the Windows client that lets you use certificates stored on smart cards (like CAC/PIV) for login and other cryptographic operations. It does not issue or provision certificates onto NSS tokens. Certificate enrollment happens through the PKI infrastructure and the specific provisioning tools used to load those issued certificates onto the token or card. NSS tokens, which rely on a PKCS#11 interface, are given access to the already-issued certificates rather than being issued by ActivClient Agent itself. On SIPR, the workflow follows the same principle: enrollment through the PKI system, then using ActivClient to access the certificates on the smart card, not to issue them to NSS tokens.