I’ve manged to obtain the certificates. Thank you for pointing me in the right direction, I could’ve sworn that I had everything configured properly!
In this case, my firewall was configured okay and the NAT rules were in place. The problem was with the external DNS zone - the autodiscover and mail records were not pointing to the public IP address.
Luckly, I had short TTLs 
Cheers!