There is the alternate way for internal networks to use a self signed cert authority (registered with each machine), and then use that to sign a machine's indiv

There is the alternate way for internal networks to use a self signed cert authority (registered with each machine), and then use that to sign a machine's individual cert. All other devices that are signed using the CA are accepted. Nothing is leaked using this method. I remember seeing a good tut on this once... but can't find it atm.