this may help you http://technet.microsoft.com/en-us/library/cc740173(v=ws.10).aspx

Hi, I want to configure some servers to forward their event logs to a central server. All servers are running Windows Server 2008 R2. My problem now is that those servers are not in the same domain. In http://msdn.microsoft.com/en-us/library/bb870973(VS.85).aspx under "Setting up a source initiated subscription where the event sources are not in the same domain as the event collector computer" it says "The collector computer should have a server authentication certificate (certificate with a server authentication purpose) in a local computer certificate store" and "The source machine should have a client authentication certificate (certificate with a client authentication purpose) in a local computer certificate store ", but i have absolutly no clue how to do that. Can anybody help me? I would really appreciate it. Thanks in advance.