Certificate for specific services:
0. Root CA
1. SIP services.
2. AV/Edge services.
0. Root CA:
You can get it from lync dc or directory control. Most of the case it is windows 2008 R2 sevrver edition.
STEP 1. Open IIS Manager from all programs and navigate to the level you want to manage.
STEP 2. In Features View, double-click Server Certificates.
STEP 3. Select a certificate and click View from the Actions pane.
STEP 4. In view certificate go to details tab and click on copy data to file .
STEP 5. Now click Next , give certificate save location and select all of the necessary attribute on the way.