In any event, the latest issue was that the certificate was fine but any attempt to RDP to any device resulted in a spurious error message regarding “Your computer can’t connect to the remote computer because your computer or device did not pass the Network Access Protection requirements set by your network administrator”. Running the Anywhere Access repair wizard (as it indicated an issue) then produced a very helpful error dialogue including “There is an issue with your Remote Desktop Services settings that cannot be automatically repaired. Please contact Product Support.” – good luck with that last part…
Again Mariette came to the rescue, another article on server-essentials fixed the underlying problem but didn’t actually allow the wizard to complete. The general gist is to install the RDS-Gateway then import your certificate.