I think this covers your first question: http://www.concurrency.com/infrastructure/how-to-deliver-remoteapps-from-windows-server-2012-rds/
In particular, you can specify a group policy and the users will automatically subscribe to the respective workspace. This will lead to icons showing up in the start menu. If you REALLY want them on desktop, then you need a script that puts the shortcuts / files on the desktop and using Scheduled Task interface, set it as a scheduled task on user login.
Certificate error can mean many things - is the cert expired or is the cert for a different domain than what it is used for or is the cert not trusted or ... something else? What is the error that you are getting?