Skip to main content

Set up and troubleshoot Credential Management and Smartcard Connect

Configuration guidance and troubleshooting steps, covering all versions of NHS Credential Management and Smartcard Connect. 

Page contents

Configuration

Chrome

1. Open Chrome and click the menu icon (three vertical dots) in the top-right corner.

2. Go to Settings > Privacy and security > Third-party cookies.

3. Check the current cookie setting:

  • The default option is Block third-party cookies in Incognito, which is fine (as long as you're not using Incognito mode).
  • If the setting is Block third-party cookies or Block all cookies, NHS Credential Management will not work.

4. To fix the issue, select Block third-party cookies in Incognito or Allow all cookies.

Alternatively:

Group Policy configuration

In the Chrome ADMX GPO, configure:

    Administrative Templates > Google > Google Chrome > Content settings > Allow cookies on these sites

Enable it and add the above URLs or the equivalent machine-level registry configuration is:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CookiesAllowedForUrls

Each allowed URL is a REG_SZ string value under this key:

  • Value Name: "1"
  • Value Type: REG_SZ (String Value)
  • Value Data: "Domain URL"

Note: Name them sequentially: "1", "2", "3" and adding the (*) prefix represents the manual Include third-party cookies on this site option.

You can deploy it under HKEY_CURRENT_USER instead if the policy is user-scoped:

    HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome\CookiesAllowedForUrls

This allow-list provides exceptions where cookies are otherwise restricted, including when BlockThirdPartyCookies is enabled. Therefore, it is preferable to allowing third-party cookies globally. See Google Chrome Enterprise policy documentation.

After applying the GPO, run: gpupdate /force

Then restart Chrome and navigate to: chrome://policy

You should see CookiesAllowedForUrls containing the three entries. If your management system displays the setting as AllowForCookiesURL, that is likely its own label for the underlying CookiesAllowedForUrls Chrome policy.

Edge

1. Open Edge and click the menu icon (three horizontal dots) in the top-right corner.

2. Go to Settings > Cookies and site permissions > Manage and delete cookies and site data.

3. If Block third-party cookies is enabled, NHS Credential Management will not work.

4. To fix the issue, change the setting to Allow sites to save and read cookie data (the default option).

Alternatively:

Group Policy configuration

In the Edge ADMX GPO, configure:

    Administrative Templates > Microsoft Edge > Content settings > Allow cookies on these sites

Enable it and add the above URLs or the equivalent machine-level registry configuration:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls

Each allowed URL is a REG_SZ string value under this key:

  • Value Name: "1"
  • Value Type: REG_SZ (String Value)
  • Value Data: "Domain URL"

Note: Name them sequentially: "1", "2", "3" and adding the (*) prefix represents the manual Include third-party cookies on this site option. It permits third-party cookies when the specified address is the top-level site. Microsoft documents this paired URL-pattern format specifically for third-party-cookie exceptions. See Microsoft Edge CookiesAllowedForUrls policy.

If you instead use just http://localhost, that allows localhost itself to set cookies, but does not precisely reproduce the option to allow other third-party cookies while localhost is the top-level site.

You can also deploy it under HKEY_CURRENT_USER instead if the policy is user-scoped:

    HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge\CookiesAllowedForUrls

The global Block third-party cookies policy can remain enabled because these entries act as site-specific exceptions.

After applying the GPO, run: gpupdate /force

Then restart Edge and navigate to: edge://policy

CookiesAllowedForUrls should appear with all three configured entries.

2. Local network access for Chromium-based browsers

Chromium based browsers are adding a new permission prompt for sites that make connections to a user's local network as part of the Local Network Access specification. Due to how the authentication service and Spine applications interact with Credential Management, Trusts will need to add these URLs with one of the following methods.

Product

URLs to add

CIS2 Authentication

Live - https://am.nhsidentity.spineservices.nhs.uk

INT - https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk

Care Identity Management (CIM)

Live - https://manage-care-identities.care-identity-service2.nhs.uk

INT - https://preprod.manage-care-identities.care-identity-service2.nhs.uk

Digital Signing Service (DSS)

Live - https://api.service.nhs.uk/signing-service

INT - https://int.api.service.nhs.uk/signing-service

Pre-grant via enterprise policy

Admins can configure Chrome and Edge to automatically allow specific origins to access local network resources without prompting the user. This is done using the enterprise policy.

Chrome

1. Using Group Policy templates

Get the latest Google Chrome Administrative Templates (ADMX files) from the Google Chrome Enterprise Help page here.

Once the templates have been configured, in the Group Policy Management editor, create a Group Policy Object, edit this and go to User Configuration or Computer Configuration > Policies > Administrative Templates > Google > Google Chrome.

Configure the Allowlist Policy

Look for the policy named Local Network Access settings. This allows you to specify which URLs under the Allow sites to make requests to local network endpoints setting, which grants access local network resources without prompting the user for permission.

2. Creating a Group Policy Object

Create the following Windows Registry key under:

      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\LocalNetworkAccessAllowedforURLs

      or

      HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome\LocalNetworkAccessAllowedforURLs

Each allowed URL is a REG_SZ string value under this key:

  • Value Name: "1"
  • Value Type: REG_SZ (String Value)
  • Value Data: "Domain URL"

Note: name them sequentially: "1", "2", "3"

Edge

1. Using Group Policy templates

Obtain the latest Microsoft Edge Administrative Templates (ADMX files) from the official Microsoft site here.

Once the templates have been configured, in the Group Policy Management editor, create a Group Policy Object, edit this and go to User Configuration or Computer Configuration > Policies > Administrative Templates > Microsoft Edge.

Configure the Allowlist Policy

Look for the policy named Network Settings. This allows you to specify which URLs under the Allow sites to make requests to local network endpoints setting, which grants access local network resources without prompting the user for permission.

2. Creating a Group Policy Object

Create the following Windows Registry key under:

      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\LocalNetworkAccessAllowedforURLs

      or

      HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge\LocalNetworkAccessAllowedforURLs

Each allowed URL is a REG_SZ string value under this key:

  • Value Name: "1"
  • Value Type: REG_SZ (String Value)
  • Value Data: "Domain URL"

Note: name them sequentially: "1", "2", "3"

User prompt: manual approval

When a site tries to access a local network resource:

  • Chrome and Edge will show a permission prompt: “Allow this site to access devices on your local network?”
  • The user must click Allow to proceed
  • Once granted, Chrome and Edge will remember the choice per origin and device

Note: If a user clicks Block, they can revisit the decision for the selected site via:

  • Chrome - Settings > Privacy and Security > Site Settings > Permissions

Under here you can Reset Permissions or set Local Network Access to Allow

  • Edge - Settings > Privacy, search, and services > Site permissions > All sites

Under here you can set Sites can ask to connect to any device on your local network to Allow

3. Registry settings (Smartcard Connect only)

If you are using Smartcard Connect you will also need to change these registry settings.

4. Enable authentication for InPrivate and guest profiles

You can configure the AmbientAuthenticationInPrivateModesEnabled policy to allow or disallow ambient authentication for InPrivate and guest profiles in Edge and Chrome browsers.

As part of this setup, you will also need to complete step 2 (cookie settings) and step 3 (local network access for Chromium-based browsers) from this configuration section.

Chrome

Registry hive: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Registry path: SOFTWARE\Policies\Google\Chrome

Add a new DWORD value:

  • Value Name: AmbientAuthenticationInPrivateModesEnabled
  • Value Type: REG_DWORD
  • Value Data choice as below:
    • 0 = Enable ambient authentication in regular sessions only.
    • 1 = Enable ambient authentication in incognito and regular sessions.
    • 2 = Enable ambient authentication in guest and regular sessions.
    • 3 = Enable ambient authentication in regular, incognito and guest sessions.

Restart the browser or reload the policies for the settings to take effect.

You should now check that the NTLM popup box no longer appears and that NHS Credential Management works as expected. 

Find out more on the Chrome Enterprise website.

Edge

Registry hive: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Registry path: SOFTWARE\Policies\Microsoft\Edge

Add a new DWORD value:

  • Value Name: AmbientAuthenticationInPrivateModesEnabled
  • Value Type: REG_DWORD
  • Value Data choice as below:
    • RegularOnly (0) = Enable ambient authentication in regular sessions only
    • InPrivateAndRegular (1) = Enable ambient authentication in InPrivate and regular sessions
    • GuestAndRegular (2) = Enable ambient authentication in guest and regular sessions
    • All (3) = Enable ambient authentication in regular, InPrivate, and guest sessions

Restart the browser or reload the policies for the settings to take effect.

You should now check that the NTLM popup box no longer appears and that NHS Credential Management works as expected. 

Find out more on the Microsoft website.

Troubleshooting

1. Multiple versions installed

NHS Credential Management automatically removes any previously installed versions before installing a new one. Attempting to run multiple versions simultaneously will result in an error stating that the application is already running.

If you have multiple versions of NHS Credential Management installed, remove all installations. Once all existing installations have been removed, you can then install the correct version. 

Should you encounter an issue installing NHS Credential Management due to remnants of a previous installation, please search for any registry values or locations under the following locations: 

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 

  • HKEY_CLASSES_ROOT\Installer\Products 

You can also check that the folder and structure has been removed from: 

  • C:\Program Files (x86)\*NHS Digital*

2. .NET Framework 4.8 missing

When installing NHS Credential Management, you may encounter the following error: 

.NET Framework 4.8 Missing

This error occurs because the required .NET Framework 4.8 is not installed on your machine. 

To resolve this, download and install .NET Framework 4.8 from the official Microsoft website then try running the NHS Credential Management installer again.

3. Smartcard authentication failure

When a user attempts to access Spine or any application, they may see the following error: 

Error code: 400_645 

This error code appears for one of the following reasons: 

  • NHS Port Service is not running

  • NHS Credential Management is not running

  • problems with communication between your browser and NHS Credential Management

Read more about how to fix error code 400_645.

4. NTLM (Windows credential) prompt while accessing web applications

If you're having issues with NHS Credential Management requiring authentication on localhost, you can resolve it by properly configuring your browser settings and the registry.

Configure browser settings

Open the relevant browser settings:

  • in Edge, go to Settings > Cookies and site permissions > Cookies and site data
  • in Chrome, go to Settings > Privacy and security > Third-party cookies > Sites allowed to use third-party cookies

Under the Allow section:

  • add http://localhost as an allowed site
  • make sure the box for Include third-party cookies on this site is checked

Restart the browser for the settings to take effect.

Configure registry settings

If you're managing browser policies using Group Policy or registry settings, you can enable localhost as an authorized authentication server by modifying the registry.

Open the Windows Registry Editor (regedit) and navigate to:

  • Edge
    • Registry Hive - HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
    • Registry Path - SOFTWARE\Policies\Microsoft\Edge
  • Chrome
    • Registry Hive - HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
    • Registry Path - SOFTWARE\Policies\Google\Chrome

Add a new string value:

  • Value Name: AuthServerAllowlist
  • Value Type: REG_SZ (String Value)
  • Value Data: http://localhost

Restart the browser for the settings to take effect.

Test and confirm

You should now check that the NTLM popup box no longer appears and that NHS Credential Management works as expected.

Why this issue occurs

Modern browsers (Edge, Chrome, IE mode) prefer the NEGOTIATE protocol for Integrated Windows Authentication. When a hostname contains dots (e.g. localhost resolving to 127.0.0.1), Windows classifies it as an Internet Zone site. This prevents automatic NTLM/Kerberos authentication and causes credential prompts.

Chrome previously defaulted to NTLM, which avoided this issue. Chrome now aligns with Edge/IE and requires explicit allowlisting.

5. Oberthur middleware deployment and ERR1000 resolution (series 8 only)

When deploying Oberthur middleware using a software deployment tool such as SCCM, Ivanti or Intune, the software is installed by the local system account instead of a user account. This means a specific registry key is not created during the process, which can cause an error.

What happens 

If the registry key is missing, you'll encounter the error ERR1000 when performing self-service operations with a series 8 smartcard. This includes self-service smartcard unlock and smartcard certificate self-renewal.

How to fix the ERR1000 error

1. Navigate to the following location in the registry:

  • HKEY_CURRENT_USER\SOFTWARE\Oberthur Technologies\Minidriver\PIVMinidriver 

2. Look for the following registry key: 

  • Name: EnableNHSEnrollment 

  • Type: REG_DWORD 

  • Value: 0 

3. If the key is missing, contact your IT team to create the key manually. Alternatively your IT team can publish it using group policy. 

Why this registry key matters

The EnableNHSEnrollment key is critical for switching between the Agile applet (default setting) and the Compatibility applet. While you do not need to use the Compatibility applet for authentication, the key ensures proper functioning after installing Oberthur middleware. 

Last edited: 7 September 2026 1:39 pm