Your solution comes to closest to mine, so I'll comment under here: - Register the domain names you'll use in your LAN, point them to a public VPS and generate

Your solution comes to closest to mine, so I'll comment under here: - Register the domain names you'll use in your LAN, point them to a public VPS and generate a wildcard TLS certificates. - Copy the certificates to the servers in your LAN. This is the annoying part, as it needs to be done after every renewal (90 days with LE). - Have Pi-hole in your LAN. It's necessary for security reasons to every serious IT professional anyway. It allows to set local DNS records - configure your domain names to point to the LAN servers. This way, you get valid certificates on private servers without exposing DNS records into the public, without having to configure each client individually. Other people here still using self signed certificates are crazy...