My option is to transfer locally generated CA to MDM server via Device Inventory, for example; then generate corresponding device profile with that CA and deploy it back to original host.

Yes, could you please tell us more about your options?