I do the following: 1. have the domain in question resolve to a server with a public IP 2. have that server generate the certs with any ACME client with HTTP

I do the following: 1. have the domain in question resolve to a server with a public IP 2. have that server generate the certs with any ACME client with HTTP challenge 3. have that server ship the certs to the actual server hosting the service via intranet 4. in the intranet, have the domain resolve to the actual server via /etc/hosts override All of that is not that hard to set up even at scale with proper config management tools. Having said that, I don't actually use it for that many services myself. The most significant one is LDAPS.