You can also self-sign for internal machines, and leave your public ones one wildcard deep.