diff --git a/certificates.go b/certificates.go
index 2bdc07b..2965712 100644
--- a/certificates.go
+++ b/certificates.go
@@ -553,6 +553,7 @@ func SubjectIsInternal(subj string) bool {
 	return subj == "localhost" ||
 		strings.HasSuffix(subj, ".localhost") ||
 		strings.HasSuffix(subj, ".local") ||
+		strings.HasSuffix(subj, ".internal") ||
 		strings.HasSuffix(subj, ".home.arpa") ||
 		isInternalIP(subj)
 }
diff --git a/certificates_test.go b/certificates_test.go
index 12221dd..f8ecc3d 100644
--- a/certificates_test.go
+++ b/certificates_test.go
@@ -163,6 +163,8 @@ func TestSubjectQualifiesForPublicCert(t *testing.T) {
 		{"local", true},
 		{"foo.local", false},
 		{"foo.bar.local", false},
+		{"foo.internal", false},
+		{"foo.bar.internal", false},
 		{"foo.home.arpa", false},
 		{"foo.bar.home.arpa", false},
 		{"192.168.1.3", false},