Ducks in a Row
One Windows service in front of the ADCS certificate authority you already run. Your machines request and renew their own certificates from it with a standard ACME client, and it warns you before anything in your CA's inventory expires.
Nothing phones home. Ever.