Comment by OutOfHere

A self-signed SSL cert could work for it. There may also exist other solutions that we are not aware of.

99% of the target users will resolve it if they want access (by installing the necessary browser extension).

As for system emails, etc., they can come through any regular domain.