Bitt, sorry, I thought you meant "Exchange" instead of Widnows Server in general.
yes, you're correct. We wanted to avoid that for various reaons, but if www.cacert.org (supposedly free CA, if ayone is interested), fails, we'll resort generating the certificates internally as you suggest.