Hadnt seen this article before – but an employee pointed it out

http://blog.schertz.name/2011/02/wildcard-certificates-in-lync-server/

its quite a good explaination of where wildcards can fall down in a lync deployment