It creates a support headache. I have rolled out client certs on a number of projects, the first over 10 years ago. I now know the perfect project that suits cl

It creates a support headache. I have rolled out client certs on a number of projects, the first over 10 years ago. I now know the perfect project that suits client certificates: authenticating work computers in high-risk transactions where you have a small base of users (500-5000). In one scenario even with 500 users we would get 2-3 support calls per day regarding the certificates. And having Verisign set us up as an intermediary with an ability to sign client certs was very expensive.