How to configure Vault TLS with a public CA and vault-internal DNS