HTTPS on non-public resources isn't doesn't need to use DIY certs, normal certs work fine. If you are afraid of hostnames showing up in CT logs, you can use wildcard certs.
Also TLS traffic inspection and antivirus can be done at endpoints.
Also TLS traffic inspection and antivirus can be done at endpoints.
It’s not like I haven’t written about that before. Here is a particularly disastrous implementation: https://palant.info/2019/08/19/kaspersky-in-the-middle--what...
There's also this post https://www.securityweek.com/antivirus-software-has-negative...
Both are bad but network level is worse.