Current Best Practices

[cookiemonster]

For KPI I did create a CA on a VM, created intermediate + certs. Then powered off. Obviously internal only. That was a few years ago.
I have toyed with the idea of using OPN instead when the time to renew comes along. It seems a neat piece of functionality to have there.

[EricPerl]

AFAIK, the prerequisite for DNS registration of STATIC mappings are:
* Unbound config to register
* Some DHCP server enabled
* Static entries defined for that server
* Static entries feature a hostname (if the domain name is empty, the OPN domain name is used)
* Unbound restarted after static entry update
I think I've seen a thread wrt entries not being picked up until the host requests the IP but I don't understand why it would be the case (given my understanding of the integration).

For PKI, I was referring to this in the OP:

But for internal stuff, I am using self-signed certs (intermediate CA)

.
I was wondering what that meant. OPN? CA software on premises? something else?

[EricPerl]

For KPI I did create a CA on a VM, created intermediate + certs. Then powered off. Obviously internal only. That was a few years ago.
I have toyed with the idea of using OPN instead when the time to renew comes along. It seems a neat piece of functionality to have there.

Can you share the software used in that VM?

[Monviech (Cedrik)]

Most likely openssl.

[cookiemonster]

Yes that's right, openssl.
The specific resource I always resort to when in doubt is https://www.feistyduck.com/library/openssl-cookbook/online/
For your own PKI is the chapter, and without OCSP so there is no need for OCSP responders. Feistyduck is my first go-to for all openssl doubts I have. Keep it in your pocket :)