Public  only on the UAG is fine, the UAG to connection server connection isn't public meaning the ssl cert is just meant to encrypt that communication, you don't need to worry about that being accepted by client devices.