Doesn't help on the intranet that easily, when the application runs on a domain not on public DNS. Also ACME can be problematic from policy POV.

My working theory is that the Venn diagram of organizations self-hosting software on an intranet with private DNS and organizations that don't have an internal CA is almost entirely disjoint.

Are the policy concerns you raise related to the above, or something else?

Your diagram is wrong tho.

Some of our customers have no trouble with certificates. The others have never heard of ACME.

But they shouldn't have to have heard of ACME to use it. If they're hosting your software on a publicly-accessible server, the UX should be roughly:

- user checks box that says they want certs issued automatically.

- your software handles the rest.

Of course there are plenty of details for the engineers to work out, but the end user shouldn't need to know any of them.

The ones that are self-hosting are more-or-less doing it specifically so that they can use non-publicly-accessible servers. So I guess that won't work.

I was thinking that you were imagining that they would need to set up some kind of internal ACME infrastructure or something. Now I see you were just imagining certbot. Maybe half the domains I've seen used aren't actually publicly resolvable. Once I saw one that was, but was actually owned by someone else.

Anyway, there is no easy way out.