This is solved everyday by sysadmins everywhere. In your case - have a public domain, issue a wildcard certificate, copy it to your endpoints. You can use bot

This is solved everyday by sysadmins everywhere. In your case - have a public domain, issue a wildcard certificate, copy it to your endpoints. You can use both private and public IPs in A records on a public server, so it's up to you what to use. If you choose to use public IPs then you can use hairpin NAT on your router to make the local clients be able to access local resources by a public IPs. Another way is move to IPv6 which eliminates most of these problems, but, obviously you need a routed IPv6 network or maintain a tunnel to IPv6 broker/provider (eg he.net if they still provide this service). > looking up the public DNS records Nope, nobody sends all your records. You need to know the exact record name to receive the value.