Platform: Exchange 2013 on a separate 2012 server within in a Server 2012 Essentials as the DC

Hi there
I am having a real problem trying to configure Exchange 2013 for external access using ARR. I have installed the Exchange server and have Outlook connecting internally. I have successfully installed Trusted third party CA remote.mydomain.com for remote access to Essentials server and this works fine

As I understand it, if I am using ARR I do not need to purchase another trusted certificate for Exchange itself. ARR will route SSL queries from remote.mydomain.com to a local self-issued certificate between the Essentials DC and the Exchange server. Is this correct?  

Am I  understanding this corr