It's nice they support FOSS, but both the CA process and Microsoft's tooling for this are stuck in the year 1999: • The registration process is painfully manua

It's nice they support FOSS, but both the CA process and Microsoft's tooling for this are stuck in the year 1999: • The registration process is painfully manual (including e-mailing scanned documents). It's like an "Enterprise" CA from before Let's Encrypt. • The website wouldn't send the final cert to any browser other than Internet Explorer. • Microsoft's signing tools are a hot garbage. All options default to "subtly wrong". To get a working signature you need a half dozen flags in an exact order, different from what the official documentation uses. • Microsoft's docs are either: a) plentiful but only tangentially related vague introduction, or b) scraps of incomplete technical information, mainly for Windows XP only. It's as if they've tried to improve it many times, but every time gave up after rewriting the first chapter. • Signing can't be automated or used remotely, because its weirdo software wants a PIN entered from the local keyboard.