This all comes down to two things: - keytool and openssh absolutely suck from a usability standpoint - testing the pipeline of generation of keys/files/certs/

This all comes down to two things: - keytool and openssh absolutely suck from a usability standpoint - testing the pipeline of generation of keys/files/certs/stores and importing/generating/signing etc is difficult - error messages, if you get them, are completely unhelpful, and often the errors are superficially not even ssl/security related. Every time I do SSL, it is a 1-4 day job, and that's with StackOverflow saving my ass on translating "why this weird error means this failure". Between the above two issues, SSL on every platform, application, database, operating system (or version of OS) has different errors. If you have a non-mainstream language, I have NO IDEA how you would get SSL up. Python, JVM, javascript, C/C++ there's a lot of eyeballs on this.