Preferably you want an internal CA. The easy alternative is to purchase a domain, and use let's encrypt to create a wildcard certificate for you. I use the int

Preferably you want an internal CA. The easy alternative is to purchase a domain, and use let's encrypt to create a wildcard certificate for you. I use the integration with my reverse proxy and it's pretty easy. You want a wildcard certificate because of the Certificate Transparency Logs, if you do it by subdomain then the list of registered subdomains will be public. Certs on multiple devices - you can most likely still use let's encrypt as most things nowadays have native integration. Otherwise you'll likely have to do it manually I recommend a domain you don't use for other things online