My preferred solution for this is a combination of Traefik and Smallstep StepCA. I run a collection of tools via Docker compose, and new certificates are issued automatically based on the hostname.

The only problem is that I have to maintain a list of DNS entries for the StepCA container as extra hosts. I haven’t found an elegant solution for this part.