If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challe

If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual internal domains don't have to be publicly resolvable or routable for that to work. This is still a WIP in the official client, but there are a number of other clients with dns-01 support[1]. Publicly trusted CAs are not allowed to issue certificates for internal domains (i.e. made-up names which don't end with an ICANN TLD.) [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash