I issue valid TLS certs for my internal servers using letsencrypt DNS challenge (there is a nice cloudflare hook for dehydrated that I use). Runs on cron, haven't had to worry about it once I set it up. (Haven't tried with concourse, but don't think that would be a problem)