Confused by RDS Connection Broker and DNS

Question

Hi,
I'm setting up the following in my lab to test before a production deployment:
RDSH01 - RD Session Host 1
RDSH02 - RD Session Host 2
RDSH03 - RD Session Host 3
RDSBG - RD Connection Broker
Everything seems to work great if I point my RDP client at one of the session hosts via a DNS round robin, it redirects me to whatever server has my disconnected sessions on and new sessions get put on servers with the least connections, great, however,
I have the following questions...
I've read on other threads that I should be pointing my RDP client at the Broker, not at a Round Robin DNS containing the Session hosts.  That said, its working just connecting to the hosts and redirecting and load balancing accordingly.  Is this
the right approach?  (I've got RDS.domain.local pointing at RDSH01, RDSH02 and RDSH03)
I'm currently using a Self Signed Cert for RDS.domain.local which is great when initially connecting, however when I get redirected to another host it comes up with a warning for eg. RDSH02.domain.local as the Session Hosts have no certs on them.
From what I've read, you don't need to put certs on every Session Host as the connection goes via the broker but when I connect to the broker I get told I'm not authorised, I can only connect to the Session Hosts.
What am I missing here?
Many thanks,
Dave

Answer 1

Thanks, I'll do that when I get to the live environment.  The client has 10 thin clients already at a remote location using a single RDSH directly, they're Windows 7 Embedded with the RDP update so I'll tweak them with the load balance details.
As for R2, unfortunately we put the order through too early for R2 and have no SA, I tried to blag an upgrade through our MS account manager but he couldn't help as the prices have gone up so we'd have to go back to distribution and re-order :(
The client is coming from a very old physical 2003 environment which hasn't been touched in years, the current 2012 RDS is 100x better than their full far desktop experience so we'll be fine.  Its 80 users over 3 RDSH's with 32Gb RAM on each although
I may increase that as we have more in the pot.  Basically 3 VMware hosts on the front of an Equallogic, each with 64Gb RAM.
I will need to have a look at HA RDCB but that just introduces a single point of failure on the SQL box, so would have to do that too, seems overkill, can I just remove the RDSH's from the collection and run without the broker if it dies and rebuild the
collection with a new broker?
How many SAN's will I need on my cert, I've got memories of having to make multiple requests the first time I did exchange years ago.
Think I'll write a step by step guide for this, I've looked at loads and most on the web don't cover the little details, just the main steps which are kinda obvious.