Create a Certificate Template for True SSO

Connect to ROOTCA or SUBCA, from MMC console  and open Certificate Template snap-in

Change the validity period to a period that is as long as a typical working day; that is, as long as the user is likely to remain logged into the system.

Change the renewal period to 50%-75% of the validity period.

Install Enrollment certificate on Enrollment server

Connect to ROOTCA or SUBCA, from MMC console  and open Certificate Template snap-in

From

Connect to Horizon enrollment server and install the enrollment Agent (Computer), open snap-in Certificate (select Local Computer)