Explanation
You can deploy and use Azure Stack Hub without a connection to the internet. However, with a disconnected deployment, you're limited to an Active Directory Federation Services (AD FS) identity store and the capacity-based billing model. Because multitenancy requires the use of Azure Active Directory (Azure AD), multitenancy isn't supported for disconnected deployments.
The implementation of Extension Host requires two wild card SSL certificates, one for the Admin portal and one for the Tenant portal.
Note: Certificate requirements
The extension host implements two new domain namespaces to guarantee unique host entries for each portal extension. The new domain namespaces require two additional wildcard certificates to ensure secure communication.
The table shows the new namespaces and the associated certificates:
Table Description automatically generated

Example:
$regionName = 'east' # The region name for your Azure Stack Hub deployment
$externalFQDN = 'azurestack.contoso.com' # The external FQDN for your Azure Stack Hub deployment Starting Certificate Request Process for Deployment CSR generating for following SAN(s):
*.adminhosting.east.azurestack.contoso.com,*.adminvault.east.azurestack.contoso.com,*.blob.east.azurestack.co Present this CSR to your Certificate Authority for Certificate Generation:
exe output: CertReq: Request Created Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-disconnected-deployment
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-extension-host-prepare
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-get-pki-certs