If you're interested in running your own CA (eg. for .lan, and not having to deal with dozens of self signed certs) and want the benefits for ACME, smallstep (step-ca) makes this really easy.

Unfortunately lots of user interfaces don't support setting a custom ACME directory (the clients mostly do, but both pfsense and proxmox require fiddling to add your custom CA working via the web UI), but it's getting better.