Adding to the point on flexibility, not that anyone would do this, but SAN certs technically have no restrictions on sub-domain wildcard names but public CA's w

Adding to the point on flexibility, not that anyone would do this, but SAN certs technically have no restrictions on sub-domain wildcard names but public CA's will not allow more than 1 sub-domain wildcard because they would lose money doing that. In a private CA one could not that one would add as many wildcard sub-domain names as they wish. e.g. *.some-name.private-tld *.*.some-name.private-tld *.*.*.some-name.private-tld and so on. Again, not that anyone would do this, but CA's will not permit it for financial reasons not technical reasons. They would instead have one buy a restricted signing cert bound to an apex domain+tld and I only know of a couple of CA's that even have that option and it is not an official offering. One has to be a partner of that CA. More common is to have customers buy one wildcard sub-domain cert per sub-domain level. Another reason one might use an internal CA is to remove all public CA trusts on hardened systems and document this in SOC1/SOC2 controls as one of many mitigating controls for data leakage. Intra-datacenter communication can be forced through a MitM proxy in addition to VPN's and deny anything that is not specifically signed with the internal CA. This is not a common setup and only a handful of orgs would need such a control, but they do exist.