I already have a practice that I use when it comes to this, but I wanted to get the community take on it.
Usually if the main url is only accessible internally with no connection to the outside world, I put the connection servers in the same cert as subject alternate names.
So for external sites, it would be three certs, one for external url with no SANs, one for connections servers and vip, one for app volumes vip and servers.
Internal sites would be two certs, one for internal vip and connection servers, and one for app volumes vip and servers.
