You can buy a cheap domain to make sure no one else uses it and just roll it on your lan. Throw some DNS ACME challenges and you have valid certificates too.
This is not how anything should work.
guess I'll be migrating things 100% over to internal...