Our AD Guy has built a new PKI infrastructure due to unsupported OS and outdated key size of the old PKI (New offline Root CA / Suborbinate issuing CA's) in the same Forest/domain as the current PKI infrastructure which i currently use for Citrix FAS without issues. The new Root/Intermediate certs of the new PKI infra has been pushed out to all domain clients via Group policy so FAS Servers / Storefront / VDA's ect should have them in the correct cert stores. I shoudnt have to re deploy the FAS Cert templates as they are stored in AD (Same AD). I know for sure i have to Re Publish the Citrix FAS templates from FAS console to the new suborbinate CA and update the FAS rule to include the new Suborbinate CA but i am not sure if i need to reauthorize the FAS server to get the FAS Authorization cert from the new PKI infra ? Also What about the kerberos/Smartcard certs for the DC's does that also have to be issued by the new PKI infra ?

When we migrated to our new CA a few years ago, we had to reauthorize FAS against the new CA servers.