&gt; after the &quot;ban&quot; they also introduces some leniency in getting an intermediate singing cert for internal domains because in many cases the reason why a company would buy a &quot;CA&quot; cert for an internal domain &#x2F; host was regulatory and auditors don&#x27;t care what the cabforum has to say.<p>Wait, so you&#x27;re saying that CAs are giving out intermediate roots to customers on the promise that they won&#x27;t give out the private key? If this is the case, please provide examples of CAs that do this, so I can open bugs in the relevant software to request the root CAs be removed.<p>TrustWave did this, and got a lot of flack for it. In the end they stated it was a mistake and they&#x27;d never do it again, so they got to keep their cert (a mistake in my opinion, as they already demonstrated that they can&#x27;t be trusted with CA powers).<p>Or did you mean they provide regular server certs or wildcards for internal domains?