Cert Questions Lync 2013 UCC San

We are currently working through a Lync 2013 Standard deployment with a reverse proxy and a front edge server.

We purchased a UUC cert from godaddy and have installed the cert on the Edge and Reverse Proxy and can make successful connections using standard and mobile clients.

When mobile devices connect over our BYOD wifi network they get prompted twice to accept the internal cert assigned to our front end server.  I understand it is best practice not to put the internal names on the external cert and am trying to figure out what is needed to allow authentication without the domain prompt.  We do not want to install the internal ca cert on all the devices and prefer to use autodiscover.

Since we have so many domains our meet url is meet.domainb.com/Domain to minimize certs.

What is the recommended approach to grant access to internal mobile devices without installing the internal cert on the devices?

Current External Cert: