I just created a wildcard with letsencrypt in the format of .internal.mydomain.com My public services all run out of .mydomain.com and all my internal services

I just created a wildcard with letsencrypt in the format of .internal.mydomain.com My public services all run out of .mydomain.com and all my internal services run out of .internal.mydomain.com I have my internal dns set to resolve any .internal calls to an internal load balancer which hosts the ca certs. The downside is that all internal services are ssl terminated at the load balancer, but this makes handling internal certs easy as they're rotated in a single location. This is Good Enough for my homelab.