I’ve been quite happy after recently switching to Hagezi

Alot of useful info in this guide if your new to OPNsense.

deleted by creator

If your running behind OPN/PFsense I’ve found the easiest solution for internal only SSL is to use the router to create the certificate chains. Yes you’ll have to import 1 CA cert on each end user device but only the one then you can crank out internal certs without and https warnings or domain constraints/challenges.