Cloud Enabled Management Certificate and SSL Questions

All,

I am doing my requirement gathering for my company so we can start to test/implement CEM and ran across a few questiosn I couldnt quite figure out with other forum posts or the whitepaper from Symantec.

1.  Do I have to convert my entire agentbase and SMP to use SSL(HTTPS) before I can enabled CEM and direct a few clients to use the CEM policies?

2.  If the answer is NO to question 1, then woudl I not select "Require SSL" in IIS and only select Accept?

3.  If the answer is YES to question 1, then would this also make me setup SSL on the Parent and all other SMP child servers in our Hierarchy?

4.  Any special method or process to follow when we have to renew our CA certificate?

Thanks for any direction you all can provide.

Clay