In regards to where the CA signed certificate goes on a two machine setup (webserver in the DMZ with web adapter, ArcGIS Server on internal domain) Enable https in IIS and use IIS to apply for the certificate on the web server machine. Enable https and use the default certificate on the ArcGIS server machine. Run the web adapter setup from the web server machine.