When you talk about security, all this self-signed SSL stuff has nothing common with security. In order to implement proper SSL configuration for internal network, you have to:
- Create your own CA server (depending on a platform, different products may be used. For example, in Windows you can use Active Directory Certificate Services, in Linux you can use CA software like EJBCA). CA certificate will be self-signed
- Provide best security for your CA server: strict physical and remote access to the server.
- Distribute self-signed root CA certificate to trust store on all affected clients
- Use this CA to issue certificates to clients and web servers
- Maintain revocation information for these certificates (CA server will periodically publish CRLs)
The reason is -- separation of concerns and security. Web servier is by default less secure. There are more chances that private key leaks from web server, because you can't guarantee adequate security for it because of web server specialization (be public). With dedicated CA you can provide better security, so less people can access it either, physically or programmatically.
If you lose SSL certificate, you can revoke it and issue a new one. Minimum server reconfiguration is required. No client reconfiguration is required. If you use CA certificate on web server, you will have to recreate every server/client certificate and reconfigure all of them in the case of key compromise.