My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but definitely would like--the ability to send digitally signed e-mail to external business partners and clients, and use the same certificate to encrypt e-mail among other members of the organization.
My question is this: Suppose we were to purchase one SSL certificate from Verisign--this certificate would be an intermediate of the root CA. But our organization could then use this for a Global PKI mail server (Say, SecureMail.OurCompany.com) for the purpose of issuing end user (leaf) certificates.
Is this possible (does it even make sense)? Could we use the Verisign-issued certificate to then issue end user (leaf) certificates to incorporate into the company e-mail (MS Exchange) system? How would this be done? What software would one use to do issue end-user certificates this way?