I’ll add on to this fantastic comment, this is exactly what I do. I use the DNS challenge with a domain I purchased to point to a private IP (my caddy server). I probably do it a bit inefficiently, but I literally have a dns entry for every subdomain of mine and have a separate caddy section for each of them for https. I’ll give an example of a simple entry that uses namecheap as the domain/dns provider:

https://subdomain.domain.net/ {

  tls {
    dns namecheap {
      api_key APIKEY
      user username
      api_endpoint https://api.namecheap.com/xml.response
      client_ip 1.1.1.1
    }
  }

  reverse_proxy 192.168.1.1:1234

} ```