[closeparen]

Typically an internal CA adds to the certificate trust store rather than replacing it.

[dilyevsky]

Yes you are correct here (although I’ve seen both methods). At least 3rd party won’t easily know which hostnames to fake though