You can also use certbot on the subdomain servers if they are on the Internet, to auto-renew individual subdomain certificates. To run a “real” CA you need a lot of opsec and infrastructure regardless of what software you use
Yes, I agree with you and I always tell everyone to stay away from creating a CA. - it’s just not worth it the workload and the risks. Either way certbot can be even used without exposing local servers to the internet with DNS challenges and other means of authentication. The wildcard has the advantage of not having to publish those subdomains publicly in some for (DNS) or another (crt.sh).
For basic dev-level purposes, CA.pl works and has been around forever, though I’m sure there is better stuff out there.