This message was deleted.

Nothing really, just make sure you read the docs. https://docs.citrix.com/en-us/federated-authentication-service/config-manage/ca-configuration.html#renew-registration-authority-certificates

It went well for us, yes for sure scary :). We validated by ensuring a user that didn't have a cert was able to grab a new one.

Can I use reauthorize in the GUI prior to the cert expiration date? Does that impact currently logged on users?

Hmm I don't remember / know odd top of my head, but lemme check my notes. I know we let our users just get new certs as they expired (we performed prod change good bit before expiration in case we had issues)

I don't think logged-on users will be affected as they already have their certs from FAS. Prob worth waiting until out-of-hours if you're in no rush. In our case the whole CA chain was expiring, so we renewed the root, re-issued the subordinate to the CA that FAS is set to use, and then hit reauthorize. It was surprisingly straight forward. We have 2 FAS servers so did one at a time. We then deleted some test users' certs from FAS and validated the change by confirming newly issued certs had an expiry date past the known-end of the expiring cert.

@David Inglis that all sounds very similar to how we handled it. I am pretty sure we were moving to a new root as well

FWIW there was 1 week left on the cert lifetime @Eric Spicer so we did not wait for expiry :)

We have to wait so long on security on certs sometimes it was worth having some leeway

Thanks for the responses. My preference is to reauthorize at least 30 days prior to cert expiration to allow for any funny business that might happen. This will be our first time doing this since implementing FAS.

Yeah for sure. Smart move imo

Excellent! Thank you for that level of detail.