Exchange certificate?

Question

Microsoft Exchange

Good day!
The question is very simple, but nevertheless very important for me. I have never signed certificates, and then the need arose after the transition of the organization to Exchange. Please tell me the easiest way to do this. I also note that the software is legal, and therefore it is also necessary to sign the certificate legally.
In fact, Exchange has three certificates, one of them is self-signing, and there are no problems with it, but here are two more, which I want to sign.
Thank you for your attention.

Answer 1

if you need certificates for external publishing, then create a CSR and sign with an external CA VeriSign, Thawte, Geotrust, Goddady, StartSSL
for internal use, then sign with your CA
technet.microsoft.com/en-us/library/aa998327.aspx

Answer 2

If the internal certificate and owa stick out, on any non-domain machines the user will have to indicate in the browser that the certificate is correct, if the certificate is from Verisign and the company, then there will definitely not be such problems.