I run a ACME server with smallstep, but yeah, that means I had to install my CA on all devices. At least it's limited to my internal domain. DNS is handled by

I run a ACME server with smallstep, but yeah, that means I had to install my CA on all devices. At least it's limited to my internal domain. DNS is handled by piHole, which forward internal requests to the opnsense. DHCP clients are on their own subdomain. The opnsense ACME clients doesn't refresh the cert properly (I have a low life time), but other than that it works nice. All services force HTTPS, except Mealie and the "homepage" (for guest access).