good overview of a process that is very confusing. I am using SAN certs through Verisign. If you use Versign as your CA, you will need to contact them to enable a new set of features in the certificate enrollment UI they have. Once that is done, you will need to use the standard IIS cert request process and not the Exchange Powershell commands. Verisign's enrollment could not read the Powershell output. Once the IIS digest is uploaded, you manually add all the domain name you need and then Verisign combines the digest with the domainnames and out pops your cert.
You will be charged for every domain name as a single cert...which is different than others and more expensive...so don't use NetBIOS.