If they are internal hostnames, don't you control both client and server? Why not create a PKI?
In my opinion the only advantage certificates from official CAs bring is that clients you have no control over are not MitMed.
In my opinion the only advantage certificates from official CAs bring is that clients you have no control over are not MitMed.
Honestly, it's not that easy. The StartSSL process is much, much, much easier.
There are a myriad of problems you need to solve when running an internal CA for your organization. Who has access to generate new certs? Is it automated, and what security controls are around that system? What audits are there around certs being cut? Who can revoke certificates? Then you get down to the details of CRL/OSCP...
While running your own PKI is great and definitely recommended, it's much easier to say "just set up PKI" than to actually do it and maintain it.