Your remote company users work from their laptops and access the applications stored in Azure by using a point-to-site VPN connections. You will use certificates generated from an on-premises-based certifiate authority (CA). Which certificate should be stored where?