The TSM Client User Guide is more helpful on this topic. See page 67. Yes, one can use a certificate issued by an internal CA. Keith