Certificate work flow

Hello,

I would like to understand how the client "outlook" receive the Certificate from the Exchange server and which service is responsible to provide it to the client.

Also how this works between the server roles and the other CAS inside the same CAS array and the 3rd-party mail Servers.

in other words what is the path or the road map the certificate deployment between the server and the client and the CAS array and DAG.

Thanks