Remote App Trusted Publisher SHA1 vs SHA256

We are trying to do Remote App via RD Web on Server 2012R2 and I'm running into a problem where the publisher is not trusted. I've put the thumbprint from the cert I'm using for the server into the GPO setting "Specify SHA1 Thumbprints of Certificates Representing Trusted .rdp Publishers" but we still get prompted for an Untrusted Publisher. I also have the SPN entered in the "Allow Delegating Default Credentials" GP setting.

I have two questions:

1.) Obviously I'm not using a SHA1 cert, so will a SHA256 cert work for this, or is that the cause of my problem?

2.) If the cert doesn't have to be SHA1, is there anything else that I'm missing?

Thanks in advance!

WB