Thawte-less, or how to bring on a bureaucratic auto-da-fe

(Hint, the last part is Portuguese - think inquisition...)
I've had the pleasure (heavy sarcasm) of dealing with Thawte this week to get a digital certificate issued. Oh my god. It's like dealing with a 3rd-world government agency. They really should send out tchochkes like kneepads with their logo on 'em, it would be totally apropos of the experience.

Ok, its reasonable that they want to verify the government registry of whatever entity you claim to represent. Since the people I'm working with run their business like a hobby farm at times, this meant registering it entirely because it hadn't existed before we got a certificate. So we get the entry all registered with the state we're in...

Thawte wants to verify that we exist through DIRECTORY ASSISTANCE. Now those of you in North America who are in the know about telecome will know that this is a lousy database to query against. Countless telecom companies can post to it and who represents "directory assistance" really depends (literally) on the phone you're calling from. What information you get from "directory assistance" is whatever your telecom company bothered to post and whatever information from the last time the owner of your physical phone line last bought an update.

Ok so in lieu of directory assistance they want a notarized letter. This is where the kneepads are required.

Their "sample" text received with "guidelines" says

Dear Sirs:
I understand that Thawte USA received a request for [a Digital Certificate or a Developer Certificate] ('Product') from (Technical Contact) SPKI Sales requesting that Thawte USA issue the Product to (Company Name) [deleted].

I am the corporate contact listed in the request. I further understand that Thawte USA was unable to validate the Company's telephone number through a third party source (phone book data base or information).

As a result, Thawte USA was not able to confirm that Technical Contact is authorized to request the Product on behalf of Company using its regular verification procedures. This notarized letter serves to replace Thawte's standard verification procedure and confirm and warrant that Technical Contact is authorized request the Product on behalf of Company. I am also representing that I have the authority to make the above representations on behalf of Company. In doing so, I understand that Thawte, USA will issue the Product to Company, which will ultimately enable secure communications between Company and its personnel and/or customers.

Sincerely,

Signature of Corporate Contact:______________________________

Full name:______________________________

Job Title:______________________________

NOTARIZATION

Notary's signature:______________________________

Notary's full name:______________________________


Notary's Seal


Now any normal human being would think that the (parenthetical things) in the first paragraph would be filled in by the writer.

Oh, no... Get it written, get it notarized along with a certification document and fax that off.

Naturally they lose it.

When they finally get one and look at it -

Sir, you altered the letter.

No, I filled in the blanks.

No, you must rewrite the letter exactly as emailed to you and have it re-signed and re-notarized.

(In the developing world this is where you send a small gift, but in the US it's not our culture - we argue. And we did...)

Finally they said,

You have to have the original representative personally cross out the extra language you added and initial it and fax it to us again.

So this takes the place of the small gift. The kneepads are well-scuffed at this point. It's finally judged acceptable (as an alternative to the NANPA directory assistance database I should bloody well think so. (Click the link you might learn something...)

Finally the certificate is issued and...

I forgot the fucking password that activates it.

Fortunately I was able to chat with Zola Mtyhobile (perhaps she's named after Helen Keller's dog?) and she was able to tell me that no one would be able to give me the link to get to the reissue process until 0600 GMT and that I had to call their sales office in South Africa to get it.

I found it in an email.

We come full circle - back to the same friendly folks that validate the documentation originally. I'll bring my kneepads and a cool drink because I think it's gonna be a long session tomorrow...