Comment by TekMol

That's why HTTPS is still a pain in the butt. 30 years after it was invented.

I don't want internally used subdomains to be public. Because of certificate transparency, the only way to achieve that is via wildcard certs.

Let's encrypt only supports cumbersome validation methods for those. Like changing DNS records every time you need to renew the cert.

Pretty annoying.