[orftz]

The only downside is that Gandi's certificates are not wildcard; i.e. they only apply to your root domain.