@joshml.extra what a coincidence I am facing exactly
the same problem with Keycloak oidc integration and the solution which @RGJ has given is promising. I have tried it, but it only worked for an IP in my case a Kubernetes pod IP.
@RGJ - Is it possible to have a DNS work the same way ? In my case it’s an Nginx Ingress URL and I see a certificate verification failure as I have an internal CA signed certs on my Nginx Controller. The ingress URL resolves to a private IP.
Thank you for this topic!! Really appreciate it 
. I had almost given up finding a solution for our air gapped scenario.