Is there a good solution for TLS certs for consumer LAN devices? My ISP’s router recently moved to requiring TLS, but I access it via it’s IP address and it doesn’t have a TLS cert for an IP address (is it even possible to get a TLS cert for a private IP address?) and so the main change is that my browser no longer autocompletes the admin password (for good reasons: don’t autocomplete passwords in TOS sessions with invalid certs!).

EDIT: Yes, I know of many ways I can solve this for my personal network. That’s not what I’m asking. How can a vendor that ships a device that is accessed only via a local network enable TLS, have some vaguely useful security guarantees, and not just add inconvenience for end users?

EDIT2: To more precisely state requirements: user buys device. Device is connected to network, where the local address might not be known in advance (and, for IPv6, almost certainly won’t be). User can connect to device using a name printed on the manual (for example, a name advertised via mDNS) that can be changed later. User does not need to configure any TLS anchors on their devices. User gets TLS connection to device with no warnings from the browser and autofill works. When user goes to a different network that happens to have the same model of device, they can tell the difference and the browser will not autofill their passwords and give them to a different device of the same class that may not be trustworthy.