A certificate chain: a certificate can be signed by a Certificate Authority (CA) using its own private key. In turn, therefore, a certificate can be verified as being signed by a CA by checking the signature against the CA's certificate (public key). Web browsers and other clients have a list of CA certificates that they trust, and can thus verify the certificates of individual servers.
https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/Cisco-Expressway-Certificate-Creation-and-Use-Deployment-Guide-X8-9.pdf CA-signed certificates (Recommended) - Users are not prompted because you are installing the certificate on the devices yourself. CA-signed certificates can be signed by a Private CA or a Public CA.
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/14_1/cjab_b_planning-guide-for-jabber141/cjab_m_planning-security-and-certificates-129.html

The migration wizard in Control Hub helps automate the transition from on-premises calling to Webex cloud services, including generating phone licenses and supporting device registration workflows during migration.

The Insights and Analytics dashboard in Control Hub provides organization-level visibility into Webex service performance, including message delivery trends, latency, and errors across users.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cloudCollaboration/wbxt/videomesh/cmgt_ b_webex-video-mesh-deployment-guide/cmgt_b_hybrid-media-deployment- guide_chapter_010.html
"Which cluster is used also depends on latency rather than just location. For example, a cloud cluster with lower STUN round-trip (SRT) delay than a Webex Video Mesh cluster may be a better candidate for the meeting. This logic prevents a user from landing on a geographically far cluster with a high SRT delay".