Distribute the Private CA certificate and the CRL

Every client that has to trust certificates of the built-in Private CA needs the CA certificate and ideally also the certificate revocation list. You can export both to a file and distribute them with your usual mechanism, for example a group policy or Intune:

$ca = Get-TLSPilotPrivateCa
Export-TLSPilotPrivateCa -OutFile 'C:\Temp\tlspilot-private-ca.cer'
Export-TLSPilotPrivateCaCrl -OutFile 'C:\Temp\tlspilot-private-ca.crl'

Get-TLSPilotPrivateCa shows whether a CA exists and which version is current. Both export commands write the current version, unless you request another version with -Version. This is relevant while clients hold a previous CA certificate. Only public material is exported, never the CA key. See chapter Private CA.