If you plan to let OPNsense do queries to your nethserver dc, it only works with a valid certificate afaik. My OPNsense router refused doing unencrypted queries. See here. In my scenario a member of the domain - nethserver is aquiring the certificates, and I have a script that copies them to the opnsense router and also to the nethserver ad container nsdc providing the domain. By the way if you plan to use the script have a look on the last post in that thread as lately letsencrypt changed its root CA certficate thus the script needed a small modification in order to work again. 