Sure. Once they verify one or more root domain names, the customer can have control over their domain space (subdomains). EDIT: The control is enforced by havin

Sure. Once they verify one or more root domain names, the customer can have control over their domain space (subdomains). EDIT: The control is enforced by having the customer issue the certificates via a GlobalSign-owned portal. (Disclaimer: I don't have any inside knowledge of what they actually do, but I believe this to be a reasonable assumption.) If someone wants to be fully independent, the only way is to accept to be treated as a CA in their own right (and undergo all audits, etc).