Explanation/Reference:
Explanation:
Web Application Proxy servers require the following certificates in the certificate store on each Web Application Proxy server:
A certificate whose subject covers the federation service name. If you want to use Workplace Join, the

certificate must also contain the following subject alternative names (SANs): <federation service name>.<domain> and enterpriseregistration.<domain>.
A wildcard certificate, a subject alternative name (SAN) certificate, several SAN certificates, or several

certificates whose subjects cover each web application.
A copy of the certificate issued to external servers when using client certificate preauthentication.

References: https://technet.microsoft.com/en-us/library/dn383647(v=ws.11).aspx#BKMK_Certs