That's true, but then you don't need something like let's encrypt. If you're doing this for an environment you already control you can have your own CA. Unless

That's true, but then you don't need something like let's encrypt. If you're doing this for an environment you already control you can have your own CA. Unless you are proposing a solution where each installer for these applications bundle the root cert so only one need be installed to trust all others. That's an interesting idea.