IT’s recommended to have multiple CAs distributed across regains within the FAS configuration to have failover and HA capability. All the respective CAs must have the smart card logon template updated .