I don't see why anyone wouldn't issue certificates from a private CA for this use case.