SOS = stuck on stupid

I'm in the midst of publishing a front-end OWA exchange mail server and can't remember which server you configure the OWA authentication on for the Exchange, Exchweb, and public folders in IIS. Is it the back-end or the front-end OWA server? My gut tells me that I publish and request the certificate for the OWA site from the back-end site. Can someone confirm?

Any responses appreciated.