Local installation internal use only

You have IT guys there. They can build certificate because they are using webservers anyway on your intranet. The only issue is to get a certificate that is approved by browsers.