There are many guides out there how to request, issue and install certificates for Exchange (like this one), so I won’t go into details here. But here’s a small guide how to request, import and then export it to be able to import it to your TMG server.

To create Certificate Request (CSR):
New-ExchangeCertificate -GenerateRequest -Path c:\certreq.csr -KeySize 2048 -SubjectName “c=SE, s=State, l=Location, o=Org, ou=IT,” -DomainName, -PrivateKeyExportable $True

Once you have sent the CSR and you have issued a certificate and sent to you, save the file as certificate.cer.

Import your certificate:
Import-ExchangeCertificate -Path C:\certificate.cer

Once imported you will also see if in the certificate MMC.

To enable the certificate, you’ll need the ThumbPrint which you can get from the following command:
Get-ExchangeCertificate | fl Issuer,Thumbprint

You then need to enable this certificate on the services you want:
Enable-ExchangeCertificate -Thumbprint [paste] -Services “SMTP, IMAP, POP, IIS”

Once installed on your Exchange server you can export it so you can import it on other Exchange/ISA/TMG servers. Since the CSR was created on this Exchange server, you need to export it with the private key and this needs to be secure with a password:
$pwd = Read-Host “Put some password” -AsSecureString
Put some password: *********
Export-ExchangeCertificate -Thumbprint [paste] -Password $pwd -Path C:\Temp\test.pfx

Then you can go ahead and import again somewhere else.