Skip to main content

Configure devices to work with Care Identity Authentication

Guidance for local IT departments configuring user devices to enable the use of smartcards with Care Identity Authentication

Supported operating systems and browsers

In accordance with the strategy outlined above the use of smartcards with Care Identity Authentication has been tested and is supported on the following operating system and browser combinations:

Operating System
Internet Explorer 11
Chrome
Edge (Chromium version)
Firefox
Windows 7 (32 bit) Yes Yes No No
Windows 7 (64 bit) Yes Yes No No
Windows 8.1 (32 bit) Yes Yes No Limited support
Windows 8.1 (64 bit) Yes Yes No Limited support
Windows 10 (64 bit) Yes Yes Yes Limited support

Note that Edge (Chromium version) refers to versions of Edge from v79 onwards that are based on the Chromium open source project.


Available device configurations

To maximise the compatibility with existing device configurations Care Identity Authentication has been designed to use a number of different mechanisms to attempt to communicate with the Identity Agent on the user's device:

NHS Credential Management

This is a new component used by Care Identity Authentication that allows a user's browser to communicate with the Identity Agent without the use of Java. It is a .Net component that uses SignalR technology. This is the mechanism recommended by Care Identity Authentication.

Note that the first version of this software was named the NHS Identity Hub and this version may still be present on some machines. The NHS Identity Hub is still supported but it is recommended where possible to uninstall the old version and replace it with NHS Credential Management.

Java Applet

Some user devices may have already been configured to use existing smartcard applications in Internet Explorer 11 by the installation of a Java JRE. Care Identity Authentication is designed to use a Java Applet to communicate with the Identity Agent if a Java JRE is present and configured correctly for use in a browser.

Chrome Extension

Some user devices may have already been configured to use existing smartcard applications in Chrome by the installation of a Chrome extension. Care Identity Authentication is designed to be able to use this extension if it is present.

ActiveX Control

Some user devices may have already been configured to use the e-Referral Service web application in Internet Explorer 11 by the installation of an ActiveX Control. Care Identity Authentication is designed to be able to use this control if it is present, however this does require a small change to the browser settings.


Limited support for Internet Explorer 11 and Firefox

The current version of NHS Credential Management does not support the use of Internet Explorer 11 or Firefox. The previous version, which was named NHS Identity Hub, worked with Internet Explorer 11 and Firefox on some operating systems. We strongly recommend that you use NHS Credential Management with either Chrome or the Chromium version of Edge. If you are constrained to using Internet Explorer 11 we recommend that you adopt the Java Applet configuration as detailed in the next section.


If you are upgrading to the latest version of the NHS Identity Agent then please take careful note of the Previous Versions of Identity Agent section of the Installation Guide. If installing an Identity Agent for the first time on a device please take note of the System Requirements described in the Installation Guide. Specifically, the need to install the Gemalto Middleware and a Java 32-bit JRE (1.8.0_251 is recommended) prior to installing the Identity Agent.

Whilst not necessary for Care Identity Authentication the installation of a Java JRE will ensure that other applications using the existing CIS authentication service will be able to work correctly.

Although NHS Credential Management will work with other versions of the Identity Agent the latest NHS version is recommended for the reasons outlined in Identity Agent FAQ. The installation files for the latest version of the Identity Agent can be found at NHS Digital Downloads - Identity Agent (HSCN connection required).

If after installing the NHS Identity Agent, the user is unable to authenticate using their smartcard, troubleshooting guidance can be found in the Administration Guide, supplied within the installation files.

Once an identity Agent has been successfully installed on a device NHS Credential Management should be installed using the installation file and guides which can be found at NHS Digital Downloads - NHS Credential Management (HSCN connection required).

To test whether the device is configured correctly to work with Care Identity Authentication you can use the Care Identity Authentication set up checker and troubleshooting guidance.


Other available configurations

Java Applet

If it is not possible to install NHS Credential Management on a user's device or if the user is not able to access a modern browser (e.g. Chrome or the Chromium version of Edge) then Care Identity Authentication can be used in combination with Internet Explorer 11, a Java JRE and the latest version of the NHS Identity Agent.

Whilst this configuration is supported both Internet Explorer 11 and Java are old technologies with limited support.


This configuration supports the use of smartcards with Care Identity Authentication on the following operating systems and browsers:

Operating System
Internet Explorer 11
Chrome
Edge (Chromium version)
Firefox
Windows 7 (32 bit) Yes No No No
Windows 7 (64 bit) Yes No No No
Windows 8.1 (32 bit) Yes No No No
Windows 8.1 (64 bit) Yes No No No
Windows 10 (64 bit) Yes No No No

Although Care Identity Authentication will work with other versions of the Identity Agent the latest NHS version is recommended for the reasons outlined in Identity Agent FAQ. The installation files for the latest version can be found at NHS Digital Downloads (HSCN connection required).

If installing an Identity Agent for the first time on a device please take note of the System Requirements described in the Installation Guide, specifically the need to install the Gemalto Middleware and a Java 32-bit JRE (1.8.0_251 is recommended) prior to installing the Identity Agent.

If upgrading to the latest version of the NHS Identity Agent then please take careful note of the Previous Versions of Identity Agent section of the Installation Guide.

After installing the NHS Identity Agent, if a user is unable to authenticate using their smartcard, troubleshooting guidance can be found in the Administration Guide supplied with the installation files.

To test whether the device is configured correctly to work with Care Identity Authentication you can use the Care Identity Authentication set up checker and troubleshooting guidance.

Chrome Extension

You may have already configured user devices to use existing smartcard applications in Chrome using a Chrome extension supplied by NHS Digital. Such devices should work with Care Identity Authentication without further change.

Whilst this configuration is supported for devices that already have the Chrome Extension installed, we recommend you install NHS Credential Management on those that do not.


This configuration supports the use of smartcards with Care Identity Authentication on the following operating systems and browsers:

Operating System
Internet Explorer 11
Chrome
Edge (Chromium version)
Firefox
Windows 7 (32 bit) No Yes No No
Windows 7 (64 bit) No Yes No No
Windows 8.1 (32 bit) No Yes No No
Windows 8.1 (64 bit) No Yes No No
Windows 10 (64 bit) No Yes Yes No

To test whether the device is configured correctly to work with Care Identity Authentication you can use the Care Identity Authentication set up checker and troubleshooting guidance.

ActiveX Control

Some organisations that use the e-Referral Service web application using Internet Explorer 11 may have already configured user devices to use an ActiveX Control created by the e-RS project (PDF) . Such devices can be made to work with Care Identity Authentication by adding the Care Identity Authentication URL (https://am.nhsidentity.spineservices.nhs.uk) to the browser's trusted sites list.

Whilst this configuration is supported for devices that already have the ActiveX Control installed, we recommend you install NHS Credential Management and use a modern browser such as Chrome or the Chromium version of Edge for those that do not.


This configuration supports the use of smartcards with Care Identity Authentication on the following operating systems and browsers:

Operating System
Internet Explorer 11
Chrome
Edge (Chromium version)
Firefox
Windows 7 (32 bit) Yes No No No
Windows 7 (64 bit) Yes No No No
Windows 8.1 (32 bit) Yes No No No
Windows 8.1 (64 bit) Yes No No No
Windows 10 (64 bit) Yes No No No

To test whether the device is configured correctly to work with Care Identity Authentication you can use the Care Identity Authentication set up checker and troubleshooting guidance.

Last edited: 23 April 2021 4:06 pm