Private CA's are the way to go. There are free tools for this sort of solutions. Requires some careful preparing but certainly possible. One should use one mast

Private CA's are the way to go. There are free tools for this sort of solutions. Requires some careful preparing but certainly possible. One should use one master CA which is used only when the signer CA's needs to be renewed etc.