I found this great CSR (Certificate Signing Request) tool named DigiCertUtil.exe in Jeff Schertz’s blog. It is a portable execution file, which means you don’t need to install it in your server.
With this tool, I was able to simply generate the CSR file for both my Lync Edge server’s external and internal NIC.
The following web-based tool can help you to decode the CSR if you want to validate it before submit it to CA.
Jackie Chen's IT Workshop 