While in Snow Leopard you may have had to script you way to fame and money to get your Mac to get a certificate from a Microsoft CA, in Lion it's mostly done for you.
Take a look at this support document for the gory details on using a profile to get your Mac to request a certificate.
Note that you can do all of this by hand, or by script, in XML and then distribute through whatever means you want to your Lion systems.
