I mean, yes? LibreSSL is pretty easy to use. An ACME server is even easier to use. And avoiding an external certificate authority means you can avoid most of th

I mean, yes? LibreSSL is pretty easy to use. An ACME server is even easier to use. And avoiding an external certificate authority means you can avoid most of the problems that exist in the worldwide PKI to begin with. If you have an ACME-compatible server you just set up an ansible script to deploy the certs for you (I think they even provide one); it's a one-time cost of a day or so, and if your sysadmin can't set it up you've got bigger problems.