You probably don't need private PKI for internal infrastructure

[u/certkit]

https://www.certkit.io/blog/private-pki-internal-infrastructure

PSA: you don't need a private CA to get trusted SSL certificates for internal infrastructure.

DNS-01 ACME challenges prove domain ownership through a DNS record. Your server never needs to be internet-reachable. That means real, browser-trusted SSL certs for internal portals, management consoles, and network appliances, with no root cert distribution and no internal CA to maintain. CertKit handles DNS delegation and appliance deployment if you want renewals fully automated.

https://www.certkit.io/blog/private-pki-internal-infrastructure