I completely agree that dealing with openssl is fiddly at best when you RYO CA. But, if your org knows how PKI works it's not a big deal; a bash script or two in the simple case or a flask app at most complex.

If your org doesn't know how PKI works shouldn't you be paying a vendor that does?