Well, ACME would be perfect, but actually any fully automated process would do.

We provide an on-prem software available via browser. And well, we want to be very nice for our customers, so upon installation we also setup a subdomain in a domain that we control and request a certificate for that. At the end of installation we provide user with HTTPS URL where the service is available and with a valid certificate :-) Of course they can later opt-out, use their domain or certificate, but we make it work without security warnings from the first moment.