Certificated authenticated communication between SEPM and Client

Hi All,

Good Day..

We are using Sep 12.1 RU1 MP1 on a windows Architecture, and we are operating globally.

We have a MSL with a Public IP, clients will report to our existing internal SEPM while they are on Public internet via Public IP (only for Policy, definition updates will took from internet), this communication is via port number 80, and our security auditing team has been guided to change this communication with certificate authenticated over port 443.

What could be the best practices and changes required on SEPM and clients to get it done?

we having approx 3000 clients on Roaming.

Best Regards

Ajin