Not only do I have the hole in my office roof repaired (yay!), I've built on my successes with openssl and running my own CA:

I now have a CA (step-ca) which I can use via ACME, generating and renewing certificates automatically.

A bit more fiddling needed, including around cron and renewal times), but this has been a good day off so far.