Challenge 3: Centralized Certificate Store vs. Windows Certificate
Store -- Solution Walkthrough

Despite the similar name, these solve different problems at a
different scale. The Windows Certificate Store is the OS-level
facility every IIS certificate ultimately has to be installed into,
with each certificate referenced by its own thumbprint in an
explicit, individually-configured binding per site. That works well
when a server hosts a handful of sites -- each one gets its own
binding pointing at its own thumbprint, managed by hand or through a
small number of scripted steps.

The Centralized Certificate Store (CCS) is a separate, optional IIS
feature built specifically for environments where that
one-binding-per-certificate model doesn't scale -- large-scale
multi-tenant hosting with many sites and certificates, often spread
across a web farm of multiple IIS servers. Instead of installing
each certificate individually and configuring a matching binding, CCS
stores certificates as .pfx files in one shared folder (frequently a
UNC network path reachable by every server in the farm), named by a
convention based on the hostname they belong to. IIS looks up the
correct file dynamically at TLS handshake time, using the SNI
hostname to find the matching filename -- no per-certificate binding
configuration required at all.

The kind of environment where CCS scales better: a hosting provider
or SaaS platform onboarding and removing tenant certificates
constantly, across many servers that all need to present the same
set of certificates consistently. Manually installing a certificate
into the Windows Certificate Store and configuring an individual
binding on every server in that farm, every time a tenant is added or
a certificate changes, doesn't scale the way dropping one .pfx file
into a shared folder does.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader doesn't conflate the two
"certificate store" concepts just because they share similar
language, and can articulate the specific scale/architecture
difference (single-server explicit bindings vs. shared-folder dynamic
lookup across a farm) that makes CCS the right fit for large,
frequently-changing multi-tenant hosting rather than a typical
handful of sites on one server.