You can do both, but ultimately it's not only the cert provisioning but the trust chain too.
My coworkers will chine-in with additional questions.
My coworkers will chine-in with additional questions.