It's trivial to do public certs with acme.sh, caddy, or certbot so you might as well. For most private networks I think it's fine to use plain HTTP.