Self-signed certificates or an internal private CA: which scales for internal services?

Self-signed certificates or an internal private CA: which scales for internal services?

For services that never face the public internet, do you self-sign each one or stand up a private certificate authority? The answer hinges on how many certificates you will manage and how you distribute trust.

Self-signed certificates are individual trust anchors: each one must be pinned or added to every client's trust store. For one host this is trivial. For ten services across a fleet of clients it becomes an unmanageable matrix — rotating any certificate means touching every trust store.

A private CA inverts this. You distribute one root (or an intermediate) to clients once; thereafter the CA issues and rotates leaf certificates freely without touching client trust stores. Tools like step-ca or HashiCorp Vault's PKI engine even speak ACME internally, bringing automated renewal to private infrastructure.

— Self-sign only for a single host or a throwaway test endpoint.
— Run a private CA the moment you have multiple services and shared clients.
— Keep the private root offline; issue from a constrained intermediate.

Further reading: RFC 5280 on path validation; the step-ca and Vault PKI documentation.

Bottom line: self-signed scales to exactly one certificate; a private CA is the correct tool the instant trust must be distributed and rotated across a fleet.