All their software is open source. You can run both the client and the CA server on your own. But your CA server won't be able to sign any certificates that wi

All their software is open source. You can run both the client and the CA server on your own. But your CA server won't be able to sign any certificates that will be recognized by Mozilla, Google, Microsoft, etc. It takes time, energy, and expertise to be a CA authority that is trusted by those organizations. I think that trying to scrimp and save is not worth the relatively small amount of money saved for something like this. We've seen over and over again that so-called "critical" open source projects cannot afford to operate that way.