Yes internal certificates are supported.
Make sure you distribute those trusted root to the devices/browsers (Group Policy or other means)..

That should get rid of the nag happening when the CA isn't trusted.
I'll check with development on other settings that might help.

Thanks for replying.

I did add the cert to the trusted root via GPO and still no luck.

 In ZSD 'Digital Cert Tool':  > New Certificate (Key Pair) >THEN-> generate CSR 
 In our AD CA: Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file > TEMPLATE = Web Server > Downloaded certificate  & certificate chain --Tryed both DER and Base 64 encoded-- 
 In ZSD 'Digital Cert Tool':  import chain > import CA reply > set active > restarted server
                                           > exported the public cert and key pair to try in trusted root cert GPO.
      . also tryed all other CERTs from our CA in trusted root

I wondered if its possible to change to http://  --no ssl --   ??? as it will only be used internally.

I opened a case #02897454 to see if they might have any ideas.

FYI – I just got it working using our internal CA. the certificate MUST have a “Subject Alternative name” and AD CA doesn’t default so do this

https://www.winsysadminblog.com/2017/05/how-to-allow-an-active-directory-certificate-authority-to-generate-certificates-with-a-subject-alternative-name-attribute/

 Just in case this helps anyone else.

Great find... Alternative name... I'll create a TID for this.
Glad you were able to find the solution.

Created a TID KM000031343 referencing this issue.
Thank you for discussing this in the forum.