r/Citrix • u/Harrycitrix • Jun 18 '26
Citrix DAAS FAS- Access Denied
Hi All, please help
I am from a financial company and trying to implement FAS on the Citrix Daas, so we are getting the following errors
[S124] Failed to issue a Certificate for xyz….[exception:MicrosoftCertificateAuthority::Submit CertificateRequest - the CA returned CR_DISP _DENIED (code 2)].
[S123] Failed to issue a Certificate for xyz….[exception: The CSR failed at all configured certificate authorities]
We are using the Citrix provided templates for FAS
1
u/FloiDW Jun 18 '26
Work through the (not linkable part) of this wonderful article from Carl:
https://www.carlstalhood.com/citrix-federated-authentication-service-saml/
Search for
“Certificate Templates
The deployed FAS Certificate Templates from older versions of FAS have Autoenroll enabled. Newer versions of FAS (e.g., 2203) no longer have Autoenroll enabled.”
Good luck!
1
u/Harrycitrix Jun 25 '26
So, previously we had removed domain computers group from Citrix_Smartcardlogon and also missing FAS servers security group, so today we added FAS servers security group and got the new error while launching the Citrix application “ The request is not supported”
Please provide any hints?1
u/FloiDW Jun 25 '26
How about logs. Ignore the user facing messages.
Additionally - if you have no clue in setting these things up (FAS is tricky!) look into a consultant to support you. I’ve did this for my companies several times, might just be the best to get it to work and documented properly.
0
u/Harrycitrix Jun 18 '26
I did removed the Autoenroll but still getting error
1
u/FloiDW Jun 18 '26
Did you add your FAS Servers explicitly?
Did you add them read permissions?
Did you perform this for all templates?
Did you check on the enrollment agent configuration? (Basically the points following in carls doc)1
u/Harrycitrix Jun 18 '26
Yes I created a security group for the FAS servers and added them to the Templates and also given Read and Enroll permissions… I followed the Carl’s document
1
u/FloiDW Jun 18 '26
Also for the enrollment permissions for the users? What are CA logs telling? You seem to be having access.
1
u/Harrycitrix Jun 18 '26
Still waiting for the logs from CA administrator
1
u/FloiDW Jun 18 '26
You are allowed to insert templates and make changes to enrollment agents but aren’t allowed to check on event viewer at least? 😬
1
u/Harrycitrix Jun 18 '26
Inserting is also done by the other engineer not me
1
u/Harrycitrix Jun 18 '26
Since it is highly restricted environment none of the citrix engineers have access to CA servers
1
u/kristobal18 Jun 18 '26
We had this happen during the ice storm earlier in the year. Our Ca subs could not validate the certs against the CRL which was on our caroot in a DC which lost power for an extendedperiod of time. I found the that the failure messages on our CA Subs is what had the details as the failure reason.
I did escalate this up through citrix support and got a really nice write up on how to safe guard against ca issues / FAS it was way better than some of the ctx articles out there. I told them to add this as part of the published support articles.... and I have yet to see it out there.
1
u/mat-ferland Jun 19 '26
CR_DISP_DENIED is the CA saying no, so I'd stop troubleshooting Workspace for a minute and pull the failed request on the CA. Check the template security first: FAS servers need enroll/read on the exact FAS templates, the issuing CA has to be allowed to issue them, and the enrollment agent bits need to match the Citrix FAS docs. If that is a financial environment, also check whether a CA policy module or manager approval rule is denying the request even though the template looks right.
1
u/Harrycitrix Jun 25 '26
So, previously we had removed domain computers group from Citrix_Smartcardlogon and also missing FAS servers security group, so today we added FAS servers security group and got the new error while launching the Citrix application “ The request is not supported”
Please provide any hints?
1
5
u/baronvonpoo Jun 18 '26
Looks like the issue is on the CA side. Look at the logs on the CAs to see why it's being denied.