Comment by mschuster91

> Only thing required for this setup to work: client needs to be able to resolve domain to internal ip.

It does not. Use DNS validation, that way you can issue LE certs for individual domains as well as wildcard certificates without needing to expose anything anywhere other than a CNAME record for the validation.