having said that, you should fight your security folks. It's perfectly normal to use internal CA for internal use. Change certificate to the console, since it's exposed to the workstations, but that's it