Well yeah, that is a fair point actually. There would be a couple of issues to sort out, but nothing major or anything we couldn't deal with.

Setting up your own CA is rather easy, for internal hostnames I'd definitely not bother with going to an external CA (nor want an external CA to have control over internal certificates).

Having set up and run an internal CA for a > 1000 person org that needed to issue a couple certificates a week, I would refute the "easy" claim.

Still easier than StartSSL's horrible, occasionally unreachable, web interface I'd bet.

I hope you don't often place bets. :P

Honestly, it's not that easy. The StartSSL process is much, much, much easier.

There are a myriad of problems you need to solve when running an internal CA for your organization. Who has access to generate new certs? Is it automated, and what security controls are around that system? What audits are there around certs being cut? Who can revoke certificates? Then you get down to the details of CRL/OSCP...

While running your own PKI is great and definitely recommended, it's much easier to say "just set up PKI" than to actually do it and maintain it.

I've always enforced a strict policy of every certificate request be asked for in person by someone with authority to ask us for one, and then a second person actually issues the certs after an hour, just in case. Nobody likes being responsible for data breaches, and I for one am a sadist and a masochist when it comes to keeping control of my systems.