In a cluster setting where TLS mutual authentication is required, it’s not uncommon to see client certificates signed by either self-signed root CA or private CA.