Share via

upgrade enterprise CA server from 2016 OS to 2025 OS

Kumar Anup 0 Reputation points
2026-05-26T09:57:19.26+00:00

Will there be any change in user certificate being used for Citrix FAS solution if we upgrade enterprise CA server from 2016 OS to 2025 OS, as I read somewhere that user certificate subject DN was missing from 2025

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Nguyen Tran 19,865 Reputation points Independent Advisor
    2026-05-29T04:32:30.29+00:00

    Hello Kumar Anup,

    I’m following up to check whether the issue has been resolved. Feel free to reply if you need further information. If the information provided was helpful, please click "Accept Answer" to help others in the community. Thank you!

    Was this answer helpful?

    0 comments
  2. Jason Nguyen Tran 19,865 Reputation points Independent Advisor
    2026-05-26T10:58:29.3066667+00:00

    Hello Kumar Anup,

    Upgrading an Enterprise CA from Windows Server 2016 to Windows Server 2025 does not fundamentally change the way user certificates are issued for Citrix FAS. The certificate templates and issuance process remain consistent, so existing user certificates should continue to function as expected.

    That said, you are correct that there have been reports of differences in how subject DN attributes are displayed in newer versions of Windows Server. In practice, this does not break Citrix FAS, but it’s always a good idea to validate your certificate templates after the upgrade. Specifically, check that the subject name and SAN fields are populated correctly, and confirm that the template permissions are intact.

    Before performing the upgrade, I recommend exporting your CA configuration and templates, then re‑importing them after the OS upgrade to ensure consistency. It’s also wise to test the issuance of a few user certificates in a staging environment before rolling out the upgrade in production.

    I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

    Jason

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-05-26T09:57:32.75+00:00

    Upgrading an Enterprise CA from Windows Server 2016 to Windows Server 2025 does not by itself remove the subject DN from existing user certificates or from templates. Existing certificates remain valid, and renewal is not automatically required after the CA OS is updated.

    For certificate-based authentication changes on domain controllers (KB5014754), the key impact is the new ObjectSID extension used for strong certificate mappings (PKINIT). The CA can operate in Compatibility mode so that existing certificates continue to work. If strong mapping using the ObjectSID extension is required, new certificates must be issued; otherwise, existing certificates can continue to be used.

    The example in KB5014754 shows that template behavior (including extensions) can be controlled explicitly with certutil and template flags. If the Citrix FAS solution depends on specific subject DN content, ensure that:

    1. The user certificate template used by FAS is not modified to remove or change the subject DN format during or after the CA upgrade.
    2. Any changes related to the new ObjectSID extension or strong mapping are validated in a test environment with FAS before enabling Enforcement mode on domain controllers.

    KB5014754 also clarifies that renewal is only needed if strong mapping via the ObjectSID extension is desired; otherwise, existing certificates continue to function in Compatibility mode. This aligns with keeping current FAS-issued user certificates working after the CA OS upgrade, provided template configuration is preserved.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.