DANE might provide a solution. See specifically the section https://tools.ietf.org/html/rfc6698#section-2.1.1, certificate usage 3:

3 -- Certificate usage 3 is used to specify a certificate, or the public key of such a certificate, that MUST match the end entity certificate given by the server in TLS. This certificate usage is sometimes referred to as "domain-issued certificate" because it allows for a domain name administrator to issue certificates for a domain without involving a third-party CA.