Hi Steven,
You could definitely use a SAN certificate but I believe that external, third-party CAs are no longer issuing certificates for internal domain names they can't verify. This may prevent you from being able to add the viewconnection.internal.local URL to the cert.
What I would personally recommend is the following:
First, set up split DNS in your environment. Basically, create and internal A record that will allow clients to resolve your external DNS name, view.external.com, to your internal Connection Server IP address.
Second, configure the HTTPS External URL (and Blast External URL, if you're using Blast) to the view.external.com hostname.
What this allows you to do is get a single certificate issued for a single URL. Because the internal Connection Server External URL is set to the same name as the External URL on your Security Server the certificate will be applied properly.
If you have any questions let me know!
-Mike