IIS LAN and WAN separate SSL certificates for the same server

You can use single public certificate for both, external and internal clients. There is no need to use separate certificate for internal clients. Keep things simple.

You can't use different certificates for the same website (*). Use a public certificate, internal clients will trust it just fine.

(*) There are workarounds, but they are quite cumberstome and you shouldn't use them unless absolutely required.