Lots of Balatro, 100%’d No Man’s Sky, and Rimworld on Deck is great.

What did you play?

Your response clearly states publicly accessible DNS. A CA does not require anything public for local SSL and can work in conjunction with whatever service they want for that which is public.

public domain for internal services

I guess they need a CA then

https://smallstep.com/docs/step-ca/

https://www.freecodecamp.org/news/docker-nginx-letsencrypt-easy-secure-reverse-proxy-40165ba3aee2/