I have dnsmasq running internally and my regular Netgear router gives out the IP of that internal host as the dns resolver. Local hosts are given subdomain names for a domain I control (pi3.example.com camera.example.com seedbox.example.com etc) and resolve to an internal IP. These domains resolve, on the public internet, to the one publically-accessable host in my network. That machine runs certbot and gets the cert. It then rsyncs the certs to the internal machines every renewal.