For internal websites, be your own CA and distribute the cert via AD (or include it in your OS image, or whatever).
In fairness if you have a heterogeneous network of legacy windows, some macs for real work, legacy blackberry and both real smartphones, distributing it "everywhere" can get kinda hard.