>> [..] Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that. > An internal CA is simply not the pro

>> [..] Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that. > An internal CA is simply not the problem here, particularly since you can audit your admins' actions. If you can properly audit your admins' actions, then that's indeed not a problem. It's easier said than done; I just tried to mention a few reasons why a lot of people suggest (IMHO rightfully so) that perhaps it's not something just about every company should do. In particular, it's you don't just have to ensure that the CA is properly defended from outside threats only. Before letsencrypt we didn't have any choice, but now the landscape is really different and in many cases I believe a company could easily defer dealing with an internal CA, especially after https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com... FWIW, certificate pinning (HPKP) and efforts like Certificate Transparency are attempts to address or at least mitigate weaknesses of the PKI system.