For the exceptions, you can sign your own using internal CA.