In my case, I don't use MRA. You can only register with the system internally, not externally. Cisco recommended using the application certificate with client authentication because using MRA would fail.

In my case, our CA doesn't support creating application certificates with the necessary CN for Expressways. Ultimately, the Expressways client certificate had to be generated with a test CA that can generate certificates with CNs that include both cl...

That way it's perfect because your SSL certificate contains both server and client authentication, so you won't have any problems.

Be careful, because the traversal zone between the VCSC and VCSE requires the client certificate to have Client authentication, not Server authentication. This will cause the traversal zone to stop working.

The solution is upgrade your expressways to X15.5. In this version, you have server certifícate and client certifícate separately.