Once dns-persist-01 becomes available/usable[1], it should make dns validation even easier.
replyAlso be careful when using split DNS and Tailscale, which increasingly won't work without MagicDNS enabled.
replyJust LE a wild card cert and slap it everywhere.
replyI get antsy about a private key being in lots of places. You've also got to worry about renewal so you might as well just have "consumer" of the wildcard just provision its own non-wildcard certificate.
replyCame here to say the same. I use DNS-Challenge rather than HTTP-challenge, and that makes internal servers trivial.
replyYou need a DNS provider which supports API calls (I use DNSimple) but the core is all very straightforward.
To prevent having to include DNSimple authentication on the client's internal server I have a small API server on the web which does the Acme work.