Users can access a secure browser and email by using the appropriate certificate from the smart card. The certificate relies on a hierarchy of certificates. Typically, the top level certificate signs the intermediate certificate and the intermediate certificate signs the site's certificate. By importing and trusting the top level certificate, you do not have to install the others.
The certificate authenticates to the web sites using SSL/PKI, and signs and encrypts emails. To authenticate to your Firefox web browser and Thunderbird email with your smart card, you configure the browser and email to read your client certificates from your CAC card.