There needn’t be, but there is. I worked with a software system, globus, that allowed self-signed certs and trusted exchange and it was so difficult to find st

There needn’t be, but there is. I worked with a software system, globus, that allowed self-signed certs and trusted exchange and it was so difficult to find staff to get it set up. One of the really frustrating parts of PKI is the unnecessary cost. I, and a few friends, negotiate our own certs and have been going well for many years with the same certs (knock wood), but all the widely accepted protocols require a third party and those third parties charge quite a bit. And I don’t know any commercial CAs that issue perpetual client certs, which is what I want.