This message was deleted.

I seem to remember one of these things doesn't play nice with other certificates

BIS-F helps you take care of this and requests a cert on startup, or you can script it yourself. We've run into issues where BIS-F tries to auto assign the cert based on FQDN but the VM has multiple certs being issued for different purposes (all with same FQDN) and BIS-F was choosing the wrong one, so we had to script something that could interrogate the cert a bit further and select the correct one.

Oh cool, I’ll take a look at bisf

nw - it's a standard part of my deployment for non-persistent images, helps with a ton of other things as well

I've used it for sealing but not for startup tasks

Great for things like deploying FSL rules from central share, managing the log file locations, etc etc. I may have mistated the function sorry - If you enable the GPO for SSL, it will try to auto assign the cert for SSL VDA, but doesn't actually do the request part - if your standard GPO PKI policy is not doing this properly (or if you have something different eg my multiple cert scenario above) then you will need to handle that via machine startup script or similar

I haven't even started on it, the client just threw out they wanted SSL VDA after telling us they also wanted okta

I ignored the FAS bit of your message sorry - the computer cert for SSL VDA and the user cert for FAS are separate, in separate stores of course so it should be fine - the config for those two items doesn't cross over at all. Main thing is making sure the GPO for auto-enrollment of the computer cert is working for the SSL VDA, -most- of the time it works for me out of the box