Forgive my ignorance, but if you're issuing certificates for internal hostnames that you want to keep private, why would you need a public cert? Wouldn't an internal CA be better?