It's easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don't think a device I don't control has ever accessed anything I selfhost, or ever will.
I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.
Nothing exposed to the internet at all. There is a record of my hostnames on Let's Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.
If you are interested in this, also check out Robert Reich's course Wealth & Poverty, which until his recent retirement he taught at Berkley. He's probably best known for being Clinton's secretary of labor, so not just someone who's only taught at universities.
His course goes more into the incentives built into the economy do not merely encourage but effectively require this sort of behavior, among other topics. A key takeaway that resonated with me is the observation that there have always been greedy, bad actors in the economy armed with too much power. It is wrong to simply blame individual companies, or their boards - though don't let them off the hook either.
If at nothing else, it's one of the few investigations of the intersection between economics and power that I've found, and an important subject that otherwise doesn't fit into any particular silo.