It all depends on what you want to do.
First, unless you only have two machines and really need a cheap solution, avoid self-signed certificates. They are free and easy to generate but maintenance becomes exponentially more difficult as you add servers leading to improper behavior (blindly trusting certs permanently on every server, using certs with very long expiration, etc.).
Now, there are two other options: setting up you ow CA or using an external root.
Setting up your own CA is tricky: on one hand, it's very easy to do, on the other, it's pretty hard to do it right: there are plenty of very easy traps to fall for that will substantially decrease the security (and sometimes usability) of your PKI so it's a solution that need to be carefully planned, tested, implemented and maintained.
That said, having an internal CA (assuming it is properly setup and maintained) will give you plenty of very powerful tools for setting up internal security and it makes managing individual server certificates MUCH easier (in some situations, it can be completely automated).
The alternative is to use a commercial CA. If the following conditions are met, then it is a pretty good solution:
- Your security needs falls in the standard offering (for instance, if you just want to secure web servers).
- You plan to use exclusively public domains that you own (i.e. no "mycompany.local", no IP address, no "short" NetBIOS names).
- You might need, at some point, to offer external access to some (or all) of your internal machines.
One final advise: avoid using a single wildcard certificates on multiple servers. That will make it harder to maintain your private keys securely and breaching a single server will leave your whole infrastructure in vulnerable.