Publicly verifiable Certificate Authority for internally hosted services

There are a number of internally hosted services that require TLS/mTLS encryption and verification.  The leading example is Elasticsearch, which is hosted in multiple locations and requires TLS and mTLS for internal transport layer and client HTTP. Currently, this is handled with a privately managed self-signed CA, but this is becoming increasingly problematic because it requires CaCert distribution to the increasing number of clients  - applications and users. This could be resolved with a delegated CA, that has been signed by publicly recognised CA, so that the certificate chain is already widely known/distributed.