There’s a few ways, but for example you can use a service like cloudflared which comes with its own certs (and then set up WAF rules to only allow your IP), or you could set something up using let’s encrypt via reverse proxy (for example, using Opnsense and the let’s encrypt plugin which actually validates domains that aren’t otherwise exposed to the internet, there by giving you full blown validated SSL).

If you don’t care about validation errors then you can use nginx reverse proxies (locally, not exposing any ports externally) and apply self-signed certs through the proxy regardless of whether or not the software allows SSL config.