Probably mutual TLS. There is a whole completely unofficial website that just walks people through debugging issues with CAC authentication…