Comment by dharmab

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days.

If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.