It sounds like using Let’s Encrypt makes sense for your use case since people are accessing these appliances via a web browser, but for “normal internal servers

It sounds like using Let’s Encrypt makes sense for your use case since people are accessing these appliances via a web browser, but for “normal internal servers” the right answer is almost definitely to use your own internal PKI, not to use wildcard certs. See: https://github.com/cloudflare/cfssl https://github.com/cloudflare/cfssl https://github.com/hashicorp/vault https://github.com/hashicorp/vault https://github.com/smallstep/certificates https://github.com/smallstep/certificates