- if you have FQDN for the internal websites then you will not have any problems getting certificates. They are dirt cheap now.
- if your servers behind the proxy have names like webserver1.local than forget about trusted CA signed SSLs. In that case you ether change addresses to FQDN or set up your own CA.
If your CA gets breached then you will have to revoke all your certs!
Do you have those websites behind PROXY with internal IPs or are they accessible (but protected by firewalls) through the normal, "external" IPs?
Giving SSL to the proxy only means that there could be no encryption between proxy and servers. This will be like a "Man In The Middle Attack" - you will trust Proxy BUT NOT WEBSITES.
Now, SSL is about the trust. To stand up a proper internal CA, then add 2ndary CA, sign 2ndary CA, distribute and install root CA certificates, maintain them, maintain your own signed SSLs it's just not worth the hassle. AlphaSSL is about $10/year with discounts for multiple years. You don't have to worry about standing up and protecting your own CA, distributing certificates etc - AlphaSSL is signed by GeoTrust and is well trusted across the board. You could use other CAs as well - this is just an example.