FAS logon fails with an error "The username or password is incorrect". Events are logged on CA/FAS/VDA/Domain Controllers that one of the CAs is not trusted, usually after a CA Certificate is changed/renewed.

1. Check if the new CA Certs are present in the Trusted Stores of CAs, FAS Servers, VDAs and Domain Controllers.
   • This should happen automatically in an AD environment, but if it doesn't we have to add the Certs manually. This can be done in different ways; Domain Admin permissions are required to publish the Certificates in AD.

• Using Certutil commands

• Using ADSIEdit

1. Browse to this location and add the Certificates manually to the respective Containers:

2. If the new CA Certs are already present in the Trusted and Intermediate CA Stores, usually they are, and we still get the error that a CA is not trusted, add the Certs to the NTAuth Stores as well. It can be done in the same way as shown above. The certutil command would be:

• certutil -dspublish -f filename NTAuthCA
   

Problem Cause