Alternative-1:

You may use internal/external FQDN names as different FQDN names. In this case you might have a server certificate with CN = ‘FQDN which will be accessed dominantly’, subject alternate name (SAN) field should include ‘other FQDN’.

Requirements for Alt.1

• The certificate authority should be able generate SAN certificates.
• Your application should suppport SAN certificates.

Alternative-2:

• In your DNS configuration, your external users should see the same FQDN (host1.domain.com) both externally and internally but will resolve to a external address on the external DNS servers and will resolve to an internal address of the host when querying in the internal network. There is no need for SAN field.

Requirements for Alt.2

• Probably will need an internal DNS Server if it does not exist.

Self-signed cert.may work if the CN is the FQDN (or hostname) with outside Fqdn DNS queries of your server resolve to the external IP of your server and internal DNS resolution to the internal IP of your server.

For all the cases, the clients that access the application will probably need the CA certificate of the issuing CA’s root CA in the trust chain and put this CA Certificate in the Trusted Root store of the clients except if you provide the server certificate from a well-known CA .

In the case of a self signed certificate, you will need to put this CA certificate to Trusted Root store of the clients, which may not be an optimal solution.