I'm also doing this. I have a wildcard certificate for *.local.example.com (and local.example.com), and a local DNS server which resolves all the subdomains of

I'm also doing this. I have a wildcard certificate for *.local.example.com (and local.example.com), and a local DNS server which resolves all the subdomains of local.example.com. All local servers share the same certificate and it gets refreshed automatically every 2 months. local.example.com has a public NS entry to a custom nameserver which only exists so that letsencrypt can perform the DNS validation for that domain (and its subdomains). This way I can use server-1.local.example.com, server-2.local.example.com, workstation-1.local.example.com internally with TLS.