[Cumulonimbus]

Fortunately (and unfortunately) all the way up to the assistant vice president came from software engineers and systems engineers. So when Comodo did their little scam, the AVP called bullshit on them and told them off. (The unfortunately is that some of the higher ups are technically exceptional, they have low regard of people skills).

We're on LE for 90%. There's a client (there always is...) that demands Network Solutions certs. Yet they cannot put to words why that's their need, other than stupid bullyish business practices.

We're still trying to wrap our heads how LE plans to offer wildcards.. But I digress.

[freehunter]

Ugh, when I was a security analyst for an enterprise, I'd occasionally have Network Solutions call me and try to sell me certificates. I'd explain that it's not my decision, you've got the wrong person, how did you get this number and turns out they'd call the front desk or the help desk and say they found a security hole on our public facing websites. The security hole was that we used another company for our certs.

The real security hole was that the operators were patching through salesmen directly to the security staff without verifying who they were...

[mjevans]

Yes, the real security hole was 'operations' not sufficiently validating credentials and being a proper gatekeeper.

[majewsky]

> There's a client [...] that demands Network Solutions certs.

Are you billing them for the extra cert, and for the extra work that using a non-standard CA implies?

[Cumulonimbus]

Im not privy to billing discussions unfortunately. I know how we get the certs; we just tell our contact that we need a long cert for X machine, and 2-3 days later, it shows up in our email.

It's a pain,but we have only 14 machines we oversee, with 3 year certs on each. Nagios takes care of alerts within 60 days, so we can easily get the request in time.