One day I will setup my security onion, but I’m procrastinating

I have a router with dd-wrt and I have VLANS where only my “trusted” devices are and another for everything else (like smart things or guests)

But I get your point, thank you!

Use something like no-ip, you can get a domain for free and renewing it every 30 days with a few clicks is much easier then managing a CA.

The only downside is the TLD but if you don’t care to much about how your domain name looks it really is the best option.

I use no-ip with letsencrypt, the LE bot does the certificate stuff for me, I use a single domain with different ports for each service and no-ip sends an email every 30 days to reconfirm the domain. Simple and easy.

There is Ohmyform which is great but not updated at this point.