Safeguard Enterprise server over Internet not via VPN

Question

Having trouble when syncing with SafeGuard when not connecting via VPN, after looking at this thread: 
 https://community.sophos.com/encryption/f/discussion/104413/clients-connect-to-safeguard-enterprise-server-over-internet 
 We have this setup, but get this error when running SGNCSCC.exe tool.

MichaelMcLannahan · Answer

The SSL cert secures communication between the host and client so it's critical. I understand your frustration - I had exactly this challenge last year and despite Support suggesting otherwise, I was able to get away with it as I used an externally minted cert - so the clients picked up the change straight away as soon as I switched the cert over and restarted IIS. You have a few options though since they're domain bound but this would HAVE to have access to your AD/GPO. This works for physical PC's on site but if you have laptops and don't have an always on VPN then it's more of a challenge! When you create a config file on the server, it creates an MSI file. This contains some XML/config AND the certs. This is the easiest method of doing it to be honest - but as I said...needs installing/running on every client. 
 This is common though for certs and not a fault of Sophos as such . I do though wish there was better functionality for this, but also appreciate the security constraints of this. If the client could update itself/update certs in the same way it can do policies....we'd be onto a winner! This is made worse by the recent validity period being reduced for certs too- most are only a year now so this is a more common event than it was! 
 So - Push out the certs with AD/GPO to the domain bound clients (is the SSG server not bound to the same domain?) or create a new config file and apply it to the client. 
 
 Personally - I'd create a new config file anyway - apply it to the one client you've pictured - reboot and then test all works again?