You should be using an enterprise cert for this. You won’t have any issues with enrollment or distribution that way.