Ask HN: Self Host PKI

What is your strategy for self-hosting PKI?

right now I have a bit of a tumbleweed PKI service with two CA's (out of laziness), looking to simplify and 'do it right' and looking to learn more if there is any good literature on it.