These ones may help.
https://learn.microsoft.com/en-us/windows/win32/secauthn/key-distribution-center
https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows
https://social.technet.microsoft.com/Forums/exchange/en-US/33ad4755-e27e-40aa-bd64-e471da6c0956/do-we-need-directory-email-replication-certificates?forum=winserversecurity
https://learn.microsoft.com/en-us/skypeforbusiness/manage/authentication/assign-a-server-to-server-certificate
--please don't forget to Accept as answer if the reply is helpful--