I have used an internal DNS server, internal ACME server (smallstep which was already recommended), and liberal use of Caddy which makes using ACME insanely eas

I have used an internal DNS server, internal ACME server (smallstep which was already recommended), and liberal use of Caddy which makes using ACME insanely easy. I would highly commend it - you just put caddy on the front of everything, and let everything else run unencrypted over loopbacl. Works a treat!