TLS certificates for internal services done right

No self-signing headaches, no TLS erros.