Precisely this. From what I've read it isn't that easy to setup a CA.

Look into step-ca though, I've heard it's.. Okay? I don't know. It seems too complicated still - I'd rather stick with pubkey auth