How can a company have its own Certificate Authority for internal use?
This is done fairly often in companies, but any browser, client, or device which is to trust the internal CA needs to have the internal CA's root key added to its trust store. Browsers which haven't been set to trust the company's CA will not see its certificates as valid.

It's possible to run a CA using only openssl, but very painful. There are projects which make it significantly easier, such as FreeIPA.