The pain point here is something like .home.arpa, which is nominally the recommended domain to use for home networks (not .local to avoid conflicts with mDNS IIRC).
There's still no good solution if you're using a domain that's not valid on the net. LE's lookup has to be able to reach the DNS server for the domain. I think it's something the industry as a whole has failed at - ensuring even LAN devices have good security without doing things like "your home network must have a publicly resolveable domain" or "run your own CA".
Comments
The pain point here is something like .home.arpa, which is nominally the recommended domain to use for home networks (not .local to avoid conflicts with mDNS IIRC).
There's still no good solution if you're using a domain that's not valid on the net. LE's lookup has to be able to reach the DNS server for the domain. I think it's something the industry as a whole has failed at - ensuring even LAN devices have good security without doing things like "your home network must have a publicly resolveable domain" or "run your own CA".