Question on using cert-manager in K8s

I just need clarification if we made the right decision utilizing cert-manager in the K8s ecosystem. We are a AWS workshop and utilize AWS EKS in 4 VPC CIDRs (i.e. corp, dev, stage, production). We currently use cert-manager with DNS-01 challenge to our main foo.com Public Hosted Zone where cert-manager has dev.foo.com, prod.foo.com, stage.foo.com, and corp.foo.com. All being for internal use. We use Envoy Gateway as an ingress controller and with everything combined with our NLB, everything works perfectly for internal services.

My other DevOps engineer and I were uncertain if we should go the HTTP-01 or DNS-01 challenge but ended up with DNS-01. The only purpose we would use it is for our internal services such as Grafana, Gitlab, ArgoCD, etc.

Did we do the right approach?

We were considering creating another Public Hosted Zone foo.internal for internal use using DNS-01 challenge to differentiate the differences.

Thanks for reading my question!