Point 1 doesn't make sense. One doesn't recommend GIMP or ImageMagick to Paint users just because you'll eventually run into limitations as you want more contro

Point 1 doesn't make sense. One doesn't recommend GIMP or ImageMagick to Paint users just because you'll eventually run into limitations as you want more control from your image editor. You can still start to use those things if and when you run into limitations. It's as much work to switch as it is to do the more complicated thing in the first place, so you might as well start with the simple default. Point 2 is the same as 1: once you want to do something and it turns out you cannot, you can always still go for an internal CA. Point 3 states the obvious: if you send internal hostnames to third parties, third parties will know of them. Perhaps it could be made more obvious that your domain names will end up in public logs (protip: wildcard), but how many people run publicly reachable services meant to be accessed by systems outside their control (not having a common internal CA, like a friend or business partner) but aren't meant to be used by the general public? This issue isn't specific to internal infrastructures. Users clicking past certificate warnings makes life as a security tester so much easier that I would say: please use a valid certificate and don't listen to anyone saying you absolutely need to do an internal CA and shouldn't use a public one, if that means you'll put off the task or if there are any end user systems where the CA won't be deployed (e.g. pentesters part of a larger organisation will often have a corporate laptop with Windows and all the policies, and a proper system running *nix for doing their job, which typically wouldn't have the CA).