Wildcard certificates come to mind, supposing that your thousand different sites correspond to the sub-domains of a single domain. This will work for both public websites and websites which are available only through LAN.
If this is not the case, i.e. if you are really using thousand different domains, then you can think of automating the generation of the certificates. If you're using (or willing to use) Let's Encrypt, the procedure is automated any way, so the number of domains won't make any difference in terms of the time you'll spend. Make sure, however, to check the quotas; trying to register a thousand domains at once will probably exceed the allowed limits.
Let's Encrypt won't let you create a certificate for a website which is not accessible from internet (or at least not accessible from Let's Encrypt servers). For those websites, I'd go with self-signed certificates. The reason you can't use self-signed certificates for public websites is that they won't be recognized by the browsers—in order to access such website, the visitor will have to accept a self-signed certificate, which is a practice which should be discouraged at all costs among non-technical users. Since you're dealing with LAN, you can probably deploy the self-signed CA to the client machines, meaning that there will be no warnings here.
Obviously, handling self-signed certificates (and properly securing private keys) requires expertise; but so do certificates which use Let's Encrypt.
I've had thoughts about possibly forwarding http traffic over a ssl socket with a shared key, and proxying all of this traffic to a main proxy connection, but I'm unsure if this is actually the way to go.
I suppose you're talking about a reverse proxy which will have to decrypt TLS traffic. This is indeed an approach which is used a lot, however, it assumes that you need to encrypt the traffic between the reverse proxy and the end user, but the traffic between the reverse proxy and the backend is completely safe. This is not always the case (what makes you think that nobody found a way to one of thousands of your servers?), and specific industries (such as banking) may have specific laws or policies which make it mandatory to encrypt traffic even inside LAN.
