DNS alias mode: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com

DNS alias mode: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... You want the name "internal.example.com". In your external DNS you create a CNAME from "_acme-challenge.internal.example.com" and point it to (e.g.) "internal.example.net" or "internal.dns-auth.example.com" When you request the certificate you specify the "dns-01" method. The issuer (e.g., LE) will go to the the external DNS server for the look up, see that it is a CNAME and then follow the CNAME/alias, and do the verification at the final hostname. So your ACME client has to do a DNS (TXT) record update, which can often be done via various APIs, e.g.: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon You can even run your own DNS server locally (in a DMZ?) if your DNS provider does not have an convenient API. There are servers written for this use case: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns * https://github.com/joohoi/acme-dns-certbot-joohoi https://github.com/joohoi/acme-dns-certbot-joohoi * https://github.com/pawitp/acme-dns-server https://github.com/pawitp/acme-dns-server