Get a TLS certificate for a name in one of your zones. Certificates are issued by the Rolodex per-zone CA and automatically published as DANE records. No command line needed.
Install this once on your machines so issued certificates are trusted.
Provision the dns-01 record with the bundled hook, e.g. rolodex-dns-cli add-record, when your client asks for the challenge.
rolodex-dns-cli add-record
(none loaded)