Hello, We are working on integrating SAML in our Citrix gateway. So far our testing looks good. Since this is just a POC, we are testing with 1-2 users. In production we have hundreds of users. Can certificate authority server issue hundreds of certificates? Should we load balance certificate authority servers? Is it possible through netscaler?

Are you talking about integrating FAS. Not sure where the CA comes in with SAML.

yes, only after integrating with FAS.

Storefront or workspace load balance the fas severs based on an algorithm they cant be load balanced with netscaler.

How about certificate authority servers?

You can add more than one CA's per FAS, but I would do that for redundancy rather than performance, by default the issued certificate from FAS is valid for 7 days, so you really don't need to issue them constantly... I have often ended up with a setup where I have configured a "primary" CA for FAS use and have another issuing CA ready in case the primary one fails

We always recommend two CAs and two fas servers in every datacenter where you have storefront. This can maybe be changed a little now that with storefront 2311 or later you can configure it to allow users to log on manually if the fas servers or cas are unavailable

(once a user certificate has been issued, it's fetched from the FAS, not from CA as long as it's valid)

@Rob Zylowski do you recall what setting you configure? is that a storefront or FAS setting?

For the fas failover? Its the second paragraph https://docs.citrix.com/en-us/storefront/current-release/whats-new.html

nice, thanks!

Yea thats a good one!

didn't see that tid bit about the Storefront webextensions command for upgrades either.

If FAS fails while you’re logged in, you’ll need to log in again to get a new cert from the second FAS server, otherwise storefront will attempt to use the cert that was issued on logon and it won’t work because that FAS server is down. Just something to keep inmind.