TLS certificates for internal services done right.

Bro, if you’re using split horizon DNS — no matter how it’s set up — you’re not doing anything right.

I guarantee that you’ll have problems of all kinds there. Reachability, security (I already spotted at least three major issues!), and flaky-ass behavior left and right.

Split horizon DNS is the way of the pain. You think it won’t happen, but it will. Terrible idea.