I've split the certificates into a master and multiple subordinate domains to simplify both our lives... Please bear with my while the vpn, mail, etc. are moved into the same setup.
Your browser will guide you in this process when you follow these links, if you pick the wrong link (ie crt under IE), the browser will let you know that you've got the wrong certificate format... It should pull up a certificate acceptance dialog post haste...
If you're on Vista, 2003/2008, you'll need to save the certificate (just pick a format, they all work), and once its downloaded, click on Open to actuall instally the certificate. it took some playing, installing the base certificate, then the higher levels, before the red bar (invalid certificate) bar on top went away.
Start with the the master certificate, and if that doesn't solve the issue (module the self-signed issue), you can use or more of the lower certificates.
I've verified these settings work on Firefox and IE 7 (on XP and 2003), if you're having issues, just let me know.
If you need a format that I don't already have here, just let me know and I'll add it.