I'd rather use an internal pki for internal-only stuff at work, but for my own homelab I do use a wildcard cert that is something like * .homelab.mydomain.com.

I'd rather use an internal pki for internal-only stuff at work, but for my own homelab I do use a wildcard cert that is something like * .homelab.mydomain.com. Sure, someone can see you have internal servers under * .homelab.mydomain.com, but they aren't going to know what specific hostnames exist there.