I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is.
Here is my situation: I have many web servers that are each running on their own LAN, and clients will access the web server from within that same LAN. I want to secure all the client-server connections (via HTTPS or anything else) on every LAN that has my web server running on it. The web server does not need to be reachable from the public internet. There will be a backend API running on the same machines that needs to be reachable from public internet, but I do not necessarily have to use HTTPS to secure this (however, would be nice if I can solve both problems with the same solution). I cannot distribute trusted certificates to clients, but I can control DNS and DHCP on the LANs (although I want to avoid this as much as possible). I also own a domain name that I can obtain a trusted certificate for.
I have identified several options, but I'm not sure which ones are even possible and I'm certain that there must be a recommended best practice for this kind of set up. I need someone to tell me what the best practice is and why.
Option 1: Every web server gets the same certificate for the same domain name, and the DNS servers on each LAN resolve the domain name to the appropriate local address.
Option 2: Every web server gets a different certificate for a slightly different domain name (aaa.yyy.com, bbb.yyy.com, ccc.yyy.com, etc.), but they are all handled under the same wildcard certificate. The DNS servers on each LAN resolve the domain name to the appropriate local address as in Option 1. Not sure if this works any differently than Option 1.
Option 3: Every web server gets a different certificate for an entirely different domain name (www.aaa.com, www.bbb.com, www.ccc.com, etc.). This domain name would be specified by the user, and the web server would be able to go ask a CA for a certificate on the fly. Not sure if this works any differently than Options 1 or 2.
Option 4: I create a CA on every LAN, and distribute the CA root certificate to every client. This is not really an option in my set up, but I'd still like to know if it's the recommended best practice.
Option 5: Each web server self signs its own certificate and browser warnings are produced in the clients. Also not really an option in my set up.
Option 6: Use some other type of encryption on top of HTTP. This avoids the DNS configuration hassle, but doesn't prevent man in the middle attacks. Is this standardly used for connections to obfuscate plaintext passwords and whatnot before HTTPS is enabled by a user on the web server GUI?