> TLS certificates for internal services* done right

* "internal services" = on a single server that is publicly routable