I just watched a video about generating acme certificates for labs that do not have a static IP. I got lost part way and hoping someone can clue me in better. Comments are saying they are running local dns, and no mention of any kind of tunnel to the web being used. Here’s the video in question.
You can use dynamic DNS. Usually firewalls have that capability or various dynamic DNS packages.
For my home lab stuff I use a real domain from Cloudflare (you can get it anywhere). Then I create DNS entries against that domain in Cloudflare, using my private IP addresses. These are created as “A” records, Proxy status is set to DNS only-reserved IP and TTL is set to two minutes. After I create the A record I can grab an API token for that DNS entry. All of this sets me up to do a DNS challenge in Acme to obtain a let’s encrypt certificate without having to open any ports.
I use one domain for my internal stuff not exposed to the internet and I use other domains that are in fact proxied to the internet like my Wordpress websites. Its the same DNS challenge process. The difference is that I use Cloudflare tunnels to expose my Wordpress sites, and I don’t tunnel any of my internal services. I expose them only over Tailscale. They say you don’t need an acme cert if you are exposing a service on a Cloudflare tunnel and that is true for the most part. But I want all my services to have fully qualified domain names and real SSL certs inside my firewall, and a Cloudflare tunnel can’t do that on its own. It only gives you an encrypted connect to the tunnel.
Let me know if you want more details. Let’s encrypt, Certbot and others have good documentation on this. I use Acme on my Proxmox nodes, TrueNAS and Synology. I use Certbot on my VMs, and I use Nginx Proxy Manager for serving up certs to all my containerized workloads. In all cases these are Let’s Encrypt certs. And in all cases I use Cloudflare. They make it easy in my opinion. Plus I use them for tunnels, Wordpress CDN/Caching, and even R2 storage. They are my one stop shop for most things internet.
If I can ever get my lab running again, I need to set this up. Having real certs for things like Kubernetes can make life a bit easier down the road. For access I’m probably going to stick with netbird, but internally it would be nicer than a local CA.
I hear nothing but good things about Netbird, but being perfectly happy with Tailscale, I am reluctant to change. Plus I have a slight man crush on Alex Kretzschmar! 
I believe the OP mentioned having a dynamic IP. So there has to be a mechanism to automatically update the IP in the DNS record when that IP changes.
not if he is only getting a cert for inside his environment. On the other hand anything exposed via Dynamic DNS, that would be correct on the outside of his environment, and potentially the back end as well, depending on how it is set up.
I did not watch the video, but I use a wildcard certificate via an API. You just have to have a domain, no static IP or public exposed services.
