If I have an existing mirror configuration and I want to enable SSL/TLS between mirror members, do I simply go to the primary member and check the check box next to "Use SSL/TLS" and click save? This is after I have already generated the certificates and keys and configured them for each failover member. 

Does the cache instance that is designated as the Certificate Authority Server have to be apart of the mirror? For example, can you have two members of a single mirror get their certificates (server/client) from a cache instance that is not associated with the mirror?