DoDIIS PKI Environment
Each user in the DoDIIS environment has 2 PKI certificates; each certificate has th
e same name and same DN, but has different key usages (Digital Signature vs. Key En
cipherment).  Both keys are loaded into Internet Explorer (IE).  The Key Encipherme
nt certificate is required for email encryption, and the Digital Signature certific
ate is used for identity verification on the web.

Internet Explorer - When IE prompts to choose the correct certificate, it will only
 allow the user to pick a certificate with a key usage of Digital Signature.

Java - When Java prompts the user to choose the correct certificate, it will allow
the user to select either type of certificate.  Since both certificates have the sa
me name, they appear to be the same, and the user is unable to tell the difference.
  There is absolutely no way to determine which the correct certificate is.  Additi
onally, each time the user it prompted, the order that the certificated appear in t
he list changes, forcing the user to guess at which certificate is the one with the
 correct type.

Problems:
When the user is prompted to choose the correct certificate from Java, they are una
ble to tell which certificate is the Digital Signature certificate.
If the user selects the wrong certificate from the list, the DUKE web server will r
eject the certificate because it\306s the wrong type.

DUKE Workaround - The DUKE team has been manually loading the Digital Signature cer
tificate into the Java keystore and disabling Java from looking in the IE keystore
for each user.