The chief security officer (CS0) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all…

An internal company CA can issue trusted certificates for internal servers at no additional monetary cost, as the organization already owns and operates the CA infrastructure and internal clients can be configured to implicitly trust it through group policies or similar mechanisms.

Using a wildcard certificate is a method for simplifying certificate management across multiple subdomains, but it does not inherently address the cost constraint nor specify the type of CA needed to establish trusted internal certificates without additional expense.

Certificates signed by a public CA would incur significant recurring costs for acquisition and renewal, directly violating the requirement to update the sites without incurring additional costs.

Self-signed certificates require manual trust configuration on every client and generate security warnings, making them impractical, unscalable, and not a user-friendly solution for a company-wide security policy.