For inside the lan/lab, I have my pem chain looks like: cold storage root-ca -> offline vault qubes VM ca -> pfsense ca -> freeipa

I use letsencrypt for externally facing services.