Internal trust does not need a public CA — and usually should not use one.
Using a public CA for internal service-to-service traffic is common and mostly wrong: it leaks your internal topology into public certificate transparency logs, and ties internal uptime to external validation. A private CA fixes both. The real question is who operates it and where the root key lives.
The pragmatic default. step-ca gives internal ACME quickly, and short-lived certificates reduce how much revocation you need to care about.
When the private CA must satisfy an auditor. EJBCA is Common Criteria certified and self-hostable.
Certificate Authority Service if the estate already sits in one cloud and you would rather rent than run.
The issuance layer, not the CA — point it at a private issuer and let Kubernetes handle the rest.
Decide root key protection first — hardware or software, and who can reach it. Everything else in a private PKI design follows from that answer.
Describe the estate — roughly how many certificates, public or internal, and what has to be automated — and we’ll send back a shortlist with the reasoning. No vendor sees your details.