CCP configuration with client certificate

Hi all,

I need to understand the certificate authentication of CCP and need few inputs as well. Please correct me my assumptions if I am wrong.

We are installing CCP servers behind load balancer.

1. We need to create server certificates for both CCP and add on SAN list about the ccp1 fqdn, ccp2 fqdn and vip fqdn.
2. Map this certificate on one by one both CCP web application on IIS and bind 443 and put ssl seeting client certificate require.
3. Ask application team to create a certificate for client certificate.
4. Get a serial number of client certificate and get it added on Application created in PVWA.
5. Ask application to get a pfx file of client certificate and use for invoking a get password.
6. On allowed machine list for Application need to add IP of application servers.
7. Enable X-forwarded-for and X-client-cert in packets under the location balancer configuration.
8. Change the web.config for allowing the VIP IP.

Do let me know if I am missing anything else or if I am wrong anywhere