This is a good call.
I thought Windows Server (or maybe just Pro?) makes this easy enough: AD must provide DNS and a CA, and any DC should be able to provide startup scripts to every workstation to install the certificates, set hostnames, etc.
For a more diverse office, with a mix of Macs and Windows machines, maybe there is a niche of an app server box / vm, or even router software that also handles that.