This should be as easy as getting the server/Wildcard cert from the CA and pointing to it on the Domino Server. Doing conversions using other tools (OpenSSL, kyrtool, etc.) should not be necessary. At a minimum have a 1-click utility in the Admin Client to create the files that do go on the Domino Server. Make this "easy".