You can use Let's encrypt and their DNS validation method, and set up a machine.internal.corp.com DNS entry pointing at its internal IP address.

Only problem is that you'll need to update DNS records every three months to get a new cert; some DNS providers have APIs that certbot can use.