There are a couple of possibilities here, given that we're talking costly and critical satellite links. 1. You set up a private PKI using a private CA. AWS wil

There are a couple of possibilities here, given that we're talking costly and critical satellite links. 1. You set up a private PKI using a private CA. AWS will sell you one for $400/month. Install the public root in the trust stores of the clients and then issue 5 year private certs for either IP addresses, or for .local and use DNS-SD. 2. You create a private domain at private.example.com. You get letsencrypt to issue a wildcard for .private.example.com. Then you set up private DNS for that zone. Server cert needs to be updated every 90 days. That involves downloading a single PEM file from your internal network.