Is your feature request related to a problem? Please describe.

We use cert-manager in air-gapped kubernetes setup for issuing certificates.
We run Azure AKS clusters and have a private ACME server providing us with certificates.
The DNS records are stored in private Azure DNS Zones.

At the moment we have to use the HTTP challenge and therefore have to open port 80 in the firewalls to allow the ACME server doing its challenge.

Describe the solution you'd like

We would like to use the DNS challenge with Azure Private DNS Zones instead of the HTTP challenge.

There has already some discussions about that in #3128 . The ticket is now two years old and I would disagree with the discussion result that DNS records should be publicly visible.
We are not allowed to publish DNS records in public DNS zones. (regulated environment)

Additional context

At the moment only the Azure APIs for managing public DNS zones are used in the azuredns issuer stuff (https://github.com/cert-manager/cert-manager/tree/fd9c01fa8ce02decf22f917535af26ec9468f988/pkg/issuer/acme/dns/azuredns ). The Azure Go SDK contains client for using azure private dns as well: https://github.com/Azure-Samples/azure-sdk-for-go-samples/blob/main/sdk/resourcemanager/privatedns/record_sets/main.go#L90

Environment details (remove if not applicable):

• Cloud-provider/provisioner: Azure AKS

wdyt?

/kind feature