We currently use secure OWA at our Exchange but also unsecure and unencrypted SMTP, POP3 and IMAP. We have those mapped to smtp.domain.com, pop.domain.com and imap.domain.com while for OWA@IIS we use publicly trusted certificate which was issued for secured.domain.com. I know one solution is to acquire one certificate for multiple domains. But what if that was not an option? How could I go implementing TLS on classic mail services like SMTP, POP and IMAP without universal certificate? I also want to keep aliases smtp, pop and imap in our DNS to not break users access to those services. So we should somehow redirect from, for instance, smtp.domain.com to secured.domain.com.
Exchange can generate its own self-signed certificates for these services. They should work tolerably well for TLS (though some TLS peers may reject self-signed certs), and depending on your user base this may work for POP and IMAP as well.
It would overall be simpler, though, to generate a certificate with the proper SANs for the services you want to offer. If you can explain why that may not be an option it would help us come up with a better solution.