Replace self-signed 'router' certificate

[ScobyD000]

Hi All, 

We have a policy to replace self-signed certificates in our environment with our own PKI certificates (wherever possible). Our Horizon connection servers are presenting self-signed certificates issued to "router/<servername>" on ports 4101 and 4002. From what I can see these are for replication between the servers and not used for clients but is it possible to replace them? I cannot find them in the certificate store.   

Thanks

[ScobyD000 · Accepted solution]

I was told it is not possible to replace these certificates but using them seems to be the most secure method. They can be turned off: 

Message Security Mode for Horizon Components in VMware Horizon 8