Part of the difficulty you're dealing with is just learning how a new system works. There are reasons for this friction, you really dont want your inhouse CA to

Part of the difficulty you're dealing with is just learning how a new system works. There are reasons for this friction, you really dont want your inhouse CA to mess up and issue an invalid cert, you want to make sure that each of your several thousand VMs are running the correct up-to-date OS and are on the correct hardware. Once you've learned how to negotiate the new environment a lot of this "friction" will be less painful.