I have a wildcard cert from LetsEncrypt, which I install on all the services on my home LAN. However, because it's a wildcard, LetsEncrypt insists that I prove domain ownership by updating some DNS
TXT records. My DNS provider doesn't support automated updates to
TXT records. So ACME won't work, so I have to do that bit by hand.
Next, I have to distribute the cert to a handful of local services, including pfSense, TrueNAS, Postfix, the Unifi Controller (extra annoying, because Java), Forgejo, and probably a couple others I've forgotten about. None of that is automated, either. It hasn't been so painful that I've bothered to write scripts for the process, so I get to do a little SSH dance every three months.
"Deploy your own!" Couple of issues there: 1) Everyone treats self-signed certs as suspicious, so they're inappropriate for Postfix TLS; 2) Every time I've tried that, Firefox and/or Chrome complain about some obscure feature not being what they expect. The latest headache had to do with OCSP stapling, which has to be turned on -- oh, whoops, now it has to be turned off... Bleah. LetsEncrypt certs Just Work, so I haven't revisited building my own CA.