This will give a creepy feeling to many security experts, but here's my two cents: The only issue with this scheme is that any device that trusts your "interna

This will give a creepy feeling to many security experts, but here's my two cents: The only issue with this scheme is that any device that trusts your "internal CA" can be MITM'd as easily as someone can use/abuse your "get a signed HTTPS cert" functionality. Assuming your LAN is truly not connected to the internet in any form or way, it seems like the benefits outweigh the risks --- no connection to the internet, fewer chances to MITM to begin with... As an additional security measure, you could use a PKIX name contraint [?] to restrict your CA to be trusted only for *.myinternal.lan, so even if your internal CA issued a cert for mail.google.com, it would be rejected by the cert chain verification. ([?]: not entirely sure this works everywhere) Alternatively, if this is a limited internet scenario, and not a truly no uplink whatsoever, maybe you could get a wildcard LetsEncrypt cert, and share that across your IOT devices.