There are certain corner cases where this doesn't work (one that comes to mind is WPA enterprise certificate negotiation in Windows XP, completely unrelated to

There are certain corner cases where this doesn't work (one that comes to mind is WPA enterprise certificate negotiation in Windows XP, completely unrelated to HTTPS). If the requirement for "virtually all browsers" includes esoteric mobile stuff I'd be concerned about intermediate certificate authorities. If you're doing desktop applications/common mobile applications, these providers will have solutions for you.