[OJFord]

But then you still need a private CA (public one is going to resolve the domain correctly and find you don't control it) so you may as well have used .internal?