World of EUC

image.png

is your SAML config using the metadata url or did you have to install the cert on the netscaler? If it’s using the URL it should pick up the new cert, but I’ve also had that fail

you’ll need to grab the new cert and update the one on the ns then, it’ll keep working after that

FAS doesn’t use that cert so just updating the NS is fine

No worries, I did the same thing the other day. I wish it was easier to use the metadata url, but sometimes azure presents multiple certs in the xml and the netscaler doesn’t pick the right one.

Manual update of that cert is safer for the reasons Mike said. Also, your NetScaler might not be able to fetch the metadata due to limited internet access and you will also need to consider the metadata refresh interval, I recall the default is quite long?

Blocking internet access from NetScaler or at least limiting it is not a stupid idea depending on your security reqs