Let's Encrypt now offers wildcard certs, so you don't have to expose specific internal domains in the certificate transparency logs anymore (just the top-level one).