Wildcard LetsEncrypt certificates on localhost are the way to go.

DNS-01 challenge is easily solved if you host your domains on an API enabled registrar, like cloudflare.

shkspr.mobi/blog/2022/01/s…