IPv6 still has the concept of "routable". You just have to decide what site-local means in terms of the routing table. In old school IPv4 you would normally a

IPv6 still has the concept of "routable". You just have to decide what site-local means in terms of the routing table. In old school IPv4 you would normally assign octet two to a site and octet three to a VLAN. Oh and you start with 10. With IPv6 you have a lot more options. All IPv6 devices have link local addresses - that's the LAN or local VLAN - a bit like APIPA. Then you start on .local - that's Apple and DNS and the like and nothing to do with IP addresses. That's name to address. You can do Lets Encrypt (ACME) for "local network addresses" (I assume you mean RFC 1918 addresses: 10/8, 172.16/12, 192.168/16) - you need to look into DNS-01 and perhaps DNS CNAME. It does require quite some effort. There is a very good set of reasons why TLS certs are a bit of a bugger to get working effectively these days. There are solutions freely available but they are also quite hard to implement. At least they are free. I remember the days when even packet capture required opening your wallet. You might look into acme.sh if Certbot fails to work for you. You also might need to bolt down IP addressing in general, IPv4 vs IPv6 and DNS and mDNS (and Bonjour) as concepts - you seem a little hazy on that lot. Bon chance mate