I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.
replies(4):
If you're going to run a serious internal network, you'll need the basic things like NTP, DNS, a CA server, and, yes, some kind of MDM to distribute internal CA certificates to your people. The real PITA is when you don't have these in place.