The ones that are self-hosting are more-or-less doing it specifically so that they can use non-publicly-accessible servers. So I guess that won't work. I was

The ones that are self-hosting are more-or-less doing it specifically so that they can use non-publicly-accessible servers. So I guess that won't work. I was thinking that you were imagining that they would need to set up some kind of internal ACME infrastructure or something. Now I see you were just imagining certbot. Maybe half the domains I've seen used aren't actually publicly resolvable. Once I saw one that was, but was actually owned by someone else. Anyway, there is no easy way out.