Your fleet already knows how to talk to a CA — certbot, acme.sh, cert-manager, Caddy all speak ACME (RFC 8555). The question is whether your internal CA speaks it back. goca's ACME head is built and shipping, and it serves your templates, not a public CA's.
An AcmeEndpoint publishes a directory at https://<head>/acme/<endpoint>/directory; set GOCA_ACME_BASE_URL to the external origin clients use, and every emitted URL derives from it. The directory advertises allowed templates through ACME profiles — a profile-aware client selects one in newOrder, others receive the default. Endpoints select the challenges you permit: http-01, dns-01, tls-alpn-01 and, for attested fleets, device-attest-01.
Under the hood, nothing special-cased: successful identifiers become RA-attested attributes, the template still decides certificate content, finalize calls the same signed-decision issuance path as REST, and the issuer lints the final bytes. One honest sharp edge is caught early: approval-gated templates are refused at endpoint apply time — because a stock ACME client polling a human approval workflow it cannot understand helps nobody.
Now I can point certbot-class clients at my own CA.