This message was deleted.
# citrix-vads
Slackbot
08/15/2023, 6:58 AMThis message was deleted.
j
John Gallacher
08/15/2023, 7:28 AMHey @Daniel Marsh - I'm having a similar challenge. I've put Azure AD/SAML/FAS in, something ive done a lot in the past. There has been a number of bumps along the way with Netscaler bugs etc. It's now working without issue, I have around 40 users in pilot. The feedback is good but I see a load of cipher / tls and FAS cert errors on the FAS servers (which are also configured as subordinate CA's). I noticed last week the new SAML gateway had the default ssl profile bound which was enabled with tls 1.0 and 1.1. I changed that on Friday but the errors persist. I'll track this thread in case there are any ideas, cheers
r
Rob Zylowski
08/15/2023, 7:37 AMThis might help on netscaler https://www.citrix.com/blogs/2021/02/10/citrix-tips-citrix-adc-cipher-security-demystified/amp/. Would have to see the errors you have in fas and storefront to understand what you are seeing there. But it should either work or not and not only sometimes thats strange.
👍 1
j
John Gallacher
08/15/2023, 5:10 PMI'm seeing loads of these on the FAS/Subordinate CAs':
John Gallacher
08/15/2023, 5:14 PMAnd loads of these... RPC/cert error, none of the users appearing in the event logs have issues getting on:
r
Rob Zylowski
08/15/2023, 5:51 PMwhat version of windows are you using for the FAS severs and what do the cipher suite order look like on them. I doint think fas has anytrhing to do with what verison of tls is used to talk to the CAs
j
John Gallacher
08/15/2023, 5:55 PMThanks, its 4 new Windows 2022 servers with defaults, ta
r
Rob Zylowski
08/15/2023, 5:56 PMhmm that makes no sense then the tls1.2 certs should be at the top fo the list
j
John Gallacher
08/15/2023, 5:57 PMAs these are Subordinate CAs I wonder if the errors are coming from somehere else and notihing to do with Citrix/FAS..
John Gallacher
08/15/2023, 5:57 PMI really cant get to the bottom of the FAS / Cert RPC errors... maybe a networking issue and its falling back to one of the other 3 FAS servers...
r
Rob Zylowski
08/15/2023, 5:58 PMI assume FAS is also not working correct
j
John Gallacher
08/15/2023, 5:58 PMI can see the same errors across all of them, but no user is having issues getting their desktop, cheers
John Gallacher
08/15/2023, 5:59 PMGo live is set for next month, Id be much happier doing that minus the errors which are a bit unsettling... I can see my own test account in there, I work fine. Also checked in with others... no issues. Very weird. The client had/has a CIS hardening policy/GPO, the errors persist with that enabled/disabled, ta