@MooCloud_Matt I think you can just use "no-op" in your situation and also use a custom wildcard certificate. The proxy can then accept just that wildcard cert.
no-op ignores DNS checks. The cert can be Let's Encrypt or not depending on if your proxy can carefully forward well-known HTTP requests.