The domain certificate is signed by my private Intermediate CA, which is then signed by a self-signed private CA.