If your host has no public IP or hostname, letsencrypt has no business issuing that host a certificate. If you wanted to, having a public facing IP that uses c

If your host has no public IP or hostname, letsencrypt has no business issuing that host a certificate. If you wanted to, having a public facing IP that uses challenge files, and just reverse proxying that specific URL-range to the private host might work. But really, if you want SSL for a private network, self-signed certs or your own trusted CA cert is the way to go. That does mean changing your browser to accept those certs. Alternatively, drop the SSL requirement, since everything is apparently on private networks.