One thing that stuck out to me: > We are implementing “certificate-based authentication” instead of the standard username/password auth against Active Director

One thing that stuck out to me: > We are implementing “certificate-based authentication” instead of the standard username/password auth against Active Directory. I wish we were all doing this. How long is it going to take to get a usable certificate-based client/user authentication mechanism on the web? edit: Also see e12e's comment.