The recommended way to do this is to have a reverse proxy with your public cert on it. Then when external users connect they will be presented with a cert they can trust.
There is, however, no technical reason why you can't put a public cert on your Front End.
Keep in mind, however, that your external users should be hitting the external web site on ports 4443 and 8080. Without a reverse proxy you must do port translation on your firewall to ensure your external web connections to 443 will land on 4443 on
the front end.