Let's Encrypt and Azure Private DNS

[Osiris]

@ceilingfish

Does this mean it's actually done from a different server in a Let's Encrypt data center somewhere?

Correct, Certbot does not verify anything, it's just the ACME client whereas the ACME server does all the validating.

Please see:

How It Works - Let's Encrypt

@ceilingfish

If so, is there any guidance on using Let's Encrypt for this kind of scenario

Let's Encrypt is a publicly trusted CA and therefore requires a publicly accessible domain name, either through DNS, HTTP on port 80 or using the ALPN challenge on port 443. Let's Encrypt can not and never will issue certificates for local only domain names.

@ceilingfish

or do I have to use a self-signed certificate instead?

For non-public domains you can only use self-signed certificates or set up your own (internal) CA.