I used this - worked like a charm:

Apple / Macintosh Resource page

edit: at least it worked the first time, now no love

edit #2: as long as you are initially prompted for your CAC keychain password (your PIN), I've found that if your certificate is initially rejected, you may have intermittent success. Keep alternating between selecting the 1st or 2nd certificate on the list a few times.

If you aren't prompted for your PIN, quit Safari, reload CAC, relaunch Safari, and try again. It's a pain, it works (sometimes).

dit #3: After a successful logon, something creates a keychain identity preference "*.mil" When you try to login at a later time, the presence of this preference appears to cause problems (AF Portal presents a "CAC Authentication Error" page). Prior to inserting CAC, and prior to launching safari, delete this identity preference from your keychain.