...

Thank you. Did the steps I outlined for touching each client (e.g not using autoenrollment) generally look correct to you?

Yes. Just use .p12 version for what you call "host" certificate. Users can't share that one - it requires password in order to be installed.

Thanks for all of the advice Ivan! John

Ivan Kalik Kalik Informatika ISP