Banish OEM self-signed certs forever and roll your own private LetsEncrypt | Ars Technica

Toss certbot or acme.sh onto some servers and baby, you got a stew going!