So I was asked to try to figure out what we would have to do to get a Code Signing certificate for our in-house software development team. Just to be clear, that team is about 4or 5 developers, writing software, databases and web sites that are primarily used by our workgroup — consisting of about 400 people — within a larger company of … well, lets just say over 10,000 employees.
The problem, of course, is that generally speaking, such a certificate is issued to a legal entity: a person or a corporation. I figured there was no harm in asking, however, whether it was possible to simply have the certificate issued to our team. I was wrong. Here is a transcript of two conversations I had over “live chat” on a couple of web pages. I’ve altered the names a bit from the originals, so don’t make fun of any “Mark” or even any “Tumola” you might know…
Just to be clear about expectations: both of these are large companies chosen by Microsoft to be one of the Trusted Root Certificate Authorities that are included by default in XP and Vista, and had links on their web pages with a photo of a very Caucasian female with text like “Chat with a sales support rep now” and “Click for live assistance” ... so I tried Verisign:
Welcome to VeriSign you are now speaking with Tumola Bonale. How may I help you?
Tumola Bonale: Hello, from which location are you chatting from today?
Customer: Rochester, NY
Customer: I have a question about your code-signing certificates … I work for a small internal software development team at a large corporation, and we need to be able to sign code at our team level
Customer: Is there any way we can get a certificate issued to the team, as opposed to, say, an individual, or the whole corporation — which would presumably involve so many levels of red tape that I wouldn’t finish until 2020
Tumola Bonale: I can get a agent to provide you with clarity regarding this issue?
Customer: Uhm, that would be great.
Tumola Bonale: May I please have your Name, contact number and e-mail address?
Customer: Joel Bennett, I gave him my work phone and email
Tumola Bonale: Thank you.
Tumola Bonale: An agent will contact you soon.
Well, not much luck there — and I still haven’t gotten a phone call, either. The only positive spin I can put on that experience is that (compared to the next attempt) at least Tumola Bonale’s name made it clear from the start that he was probably not a native English speaker … Next I tried Comodo (the cheapest of the four code-signing capable root certificate authorities available in Vista).
You are now chatting with ‘Mark’
Mark: Hi
you: Hey, I have a question about your code-signing certificates … I work for a small internal software development team at a large corporation, and we need to be able to sign code at our team level
Mark: ok
you: Is there any way we can get a certificate issued to the team (as opposed to, say, an individual, or the whole corporation — which would presumably involve so many levels of bureaucracy that I wouldn’t finish until 2020
Mark: please wait
This was followed by a long pause. So long, in fact, that the entire Verisign conversation above happened while I was waiting for “Mark” to get back to me.
Mark: we need documents for validation
Mark: may i know your company name please
you: Redacted Corporation
Mark: Based on documents we“ll issue your code signing cert
you: But see … that’s the problem, producing documents saying that I speak for my company would be impossible, at most I could go to the Org level …
Mark: please wait
Chat Information Please wait while I transfer the chat to ‘Brad’.
I have to interrupt at this point. I’m pretty sure that guy’s name is not “Mark.” He clearly doesn’t speak English as a first language (the phrasing of “Based on documents we’ll issue…” is simply not one that an English-as-your-first-language person would come up with), and he appears to have completely missed the point of my question — he’s trying to sell me a Corporate SSL certificate based on me proving that I’m a representative of a Fortune 500 company. Of course, I just represent a tiny team within that company, and I’d rather buy certificates for each individual developer on that team than try to get a certificate in the name of the company (it would never be approved anyway, but this team doesn’t publish anything externally and would have no legitimate need for such a certificate).
This is the first time I’ve ever been “transfered” by a text chat, and it’s taking longer than I expected. I’m starting to wonder if it’s worth waiting for this “Brad” fellow.
Chat Information You are now chatting with ‘Brad’
Brad: Hi,
you: Hi there …
Brad: How may i help you?
you: First time I’ve been “transferred” in a text chat … LOL
you: I work for a small internal software development team at a large corporation, and we need to be able to sign code at our team level.
you: Is there any way we can get a certificate issued to the team — as opposed to, say, an individual, or the whole corporation
Brad: Yes you can get the certificate in any of the format as you mentioned in the above but we need documents inorder to validate after placing the order.
you: OK, so … what would be acceptable as a way of validating?
Brad: We need any one of the following documents:
Brad: A. If for a company:
Brad: i. Articles of Incorporation (with address)
Brad: ii. Government Issued Business License (with address)
Brad: iii. Copy of a recent company bank statement (please blacken out the Account Number)
Brad: iv. Copy of a recent company phone bill
Brad: v. Copy of a recent major utility bill of the company (i.e. power bill, water bill, etc.) or current lease agreement for the company
Brad: B. If for an individual
Brad: i. Copy of a valid driver’s license or passport of the domain name registrant
Brad: ii. Copy of a recent phone bill or the domain name registrant
Brad: iii. Copy of a major utility bill (i.e. power bill, water bill, etc.) or bank statement of the domain name registrant
you: Hmm, so there’s no way to issue it to our internal group. It has to be issued to the whole corporation?Brad: I have mentione to types of document.
Brad: One for individual and the other one for the company.
Brad: So in the above way you can get the certificate.
you: Thanks anyway.
Brad: Ok thank you for contacting us.
So yeah. I can have “the certificate in any of the format as you mentioned in the above” as long as I can prove that I pay the bills for the whole company… I don’t think it’s stretching the facts at all to suppose that this guy simply didn’t even understand the question. They couldn’t possibly have been less helpful, although I guess I probably could take that as the answer: no, it’s not possible.
Considering the deftness with which all three of these support reps completely failed to understand my question or provide any help whatsoever, I couldn’t help thinking they weren’t real people … maybe they’re just scripted chat bots. But the fact is: a ‘bot would speak better English.
Similar Posts:
- None Found