You need to ensure that the rights account certificates issued in adatum.com are accepted by the AD RMS root cluster in contoso.com
You need to ensure that when Admin1 opens the Certification Authority console on Server1, the error message does not appear