Comment by tazard

With DNS validation it's fairly straight forward to get a wildcard cert for all your internal domains (*.my.domain)