Comment by Helmut10001

Just use wildcard certs and internal subdomains remain internal information.