You can always issue the TLS certificate on an internet-facing system that can do the corresponding ACME challenge, then give it to the internal service and hav

You can always issue the TLS certificate on an internet-facing system that can do the corresponding ACME challenge, then give it to the internal service and have all clients of that service resolve the domain name for the certificate via a static configuration in /etc/hosts. That's how I do TLS for my intranet-only LDAP server.