When deploying Indeed CM, you have to set up the usage of service account certificates to work with certification authorities (CA).

Indeed CM server needs a certificate to interact with CA. The server “communicates” with CA using this certificate, i.e. sends requests for certificates, publishes revoked certificate lists etc. The certificate is issued for the user account with CA privileges sufficient to integrate to Indeed CM.

Indeed CM server is an ASP.NET application. To use a certificate to connect to CA, the certificate should reside in the local maсhine store, even though the certificate is issued to a user.
This complies with Microsoft recommendations on using certificates in ASP.NET:

• https://support.microsoft.com/en-us/kb/901183
• https://msdn.microsoft.com/en-us/library/ms731899