TLS is fragile, and working around it is often necessary. Certs can expire or be revoked (anywhere in the chain) and the renewal process can be bugged. The time on the client (required for confirmation of certificate validity window) could be wrong (either accidentally or deliberately).
Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available.
what do you mean?
> Requiring TLS on an inter-LAN connection is mostly useless
there are many ways to intercept inter-LAN traffic, and:
> and impossible if no Internet gateway is available.
DNS validation? Run your own CA and trust it in your intranet?
2: I did say "mostly" useless. If your LAN is at risk of spoofing or MITM, then TLS probably will not solve all of your problems anyway.
3: Obviously you can create a local cert and add it to your trust chain. You'll still have problems with various embedded devices that don't have a RTC.