I guess I'm stupid then, because I spent more than an hour trying to figure an easy way to add these to my auto-provisioned servers before giving up and using the static cert instead.