https://www.openca.org/ <-- old school OpenSSL with some scripts to setup a closed loop CA. Dated, but gives you some bare bones fun stuff.