At work we have a few hundred internal self-signed certs we maintain, and I had a shower thought the other day about a light-weight certificate issuer targeted specifically towards self-signed certs in a largely trusted environment.

LessEncrypt uses the reverse DNS of the connecting host to control the Common Name and SANs on the cert (multiple SANs can be allocated based on some mapping rules). A connection back to the host for delivery of the cert helps establish a level of trust that the cert is reaching the intended authority.

I'm deploying this in my dev environment and looking for wider review and feedback on it.