@adamshostack @thedarktangent @xabean I've created an ACME gateway for this. Configure local ACME clients to use the gateway's URL, the gateway takes care of the issuance for you, regular API calls from internal client.
Gateway uses dns-01 validation so you can issue for "internal only" names as well if you use .intra.example.com for that.
Requires DNS API to set up and tear down the TXT RR.
https://codeberg.org/Sp1l/CertPortal if you're interested. It's being used at a 10k+ employee org for all internal certs.
The project has other features too