Change Auditor appears to be using is self signed certificate for communication and subscriptions. Is it possible to assign a 3rd party certificate or an enterprise-signed certificate to the Change Auditor server to use?
There is a feature enhancement to consider for a future release (no ETA):
4179: PowerShell cmdlet allows a user to replace the Change Auditor self-signed certificates being used with a cert of their choice