Yes, To support all external features you'll need external;;y published DNS A records for all three of those FQDNs. To support OC Automatic Sign-In you'll need an additional SRV record pointing to the Access Edge FQDN (both must be in the same domain namespace as the user's SIP address.
The most cost-effective solution is to use private certificates on the Edge Internal and A/V Auth roles with Public certs on the Access Edge and Web Conf roles. But for POC simply put internal private certs on all roles, and then buy public certs later and reassign them to the AE and WC roles.
Keep in mind that using private certs on the external roles will only work if the external clients trust the internal CA (happens by default with domain joined computers). Federation will only work if you give the federated partner your Root/Issuing certs as well. Public IM will NOT work without public certs.
See this article for more on setting up the certs and chain on the Edge server:
http://technet.microsoft.com/en-us/library/dd441270(office.13).aspx
Jeff Schertz, PointBridge | MVP | MCITP: Enterprise Messaging | MCTS: OCS
