Now getting the WinRM certificate from the localuser/root store. As long as the certificate has an exportable private key AND it has the right subject name (yourcloudservice.cloudapp.net) it should work.