Organization XYZ prefers not to trust any CA but only itself. It has set of certificates which are physically stored on each client and server which are trusted again only by their Enterprise CA. All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.
All other programs (Java, Node.js, .NET, etc.) keep subset of required certificates and use them to connect each other.
What is wrong with this picture? What arguments should be used to convince management to use common practice?
After all management says - we trust each other and those who want to work with us should trust us. There is no other way to communicate for us.
Question clarification: Maybe I'm wrong but I feel that explained solution is wrong. I just cannot convince management that this is wrong and I asked community to give me some arguments.
Personally (taking in account described in answers extra cost) I see only one problem - since all external sites are already marked as not private/dangerous regular user will pay no attention to such warning. It became not warning but common knowledge that web is dangerous and surfing is your own risk. Worst part - we trust only internal net but since individual computers are more vulnerable any break to any computer will expose entire internal network since it trust itself.
Actually, to be honest, that's not my problem at all. My problem is that when I try to use any other standard approaches or programs (like example Node.js tries to reach internal web api) it (as honest program) says - "self signed certificate in local chain" and refuses to access this connection. So, for me it's nightmare (or actually cost) to find solution for each program (Node.js, Java, VuGen, QTP, .NET, etc) obtain certificates and keep them in sync.
My question is what are the arguments I can use to convince management that this solution is wrong.