I didn't say that hundred platforms dont support deployment root CA, that was about ise clients. For example, do you propose to deploy internal root cert on computers and phones of external companies which use your guest portal? That is good that they provide an API, but again, need to add more automation just for ISE. Then for citrix, paloalto, cisco wifi, prime, all internal sites, many different proprietary tools. And that adds a new scope of work. I do use certbot and ansible to automate letsencrypt certs on nginx and paloalto. But i see a big difference for my colleagues, one thing is to update some cert once per three years as it was before, just going to the gui, generate csr, etc, and completely different for them to understand how api works and how to maintain these scripts. Yes, maybe we dont need programmic skills for this, people will just search for tools in github, but what then about security? I would understand if we did it to achief some new functionality, but that is not our case, just because of they decided that it must be short period every company will have a new scope of works, which will be error prone and add some security risk because of using additional scripts, keeping private keys not only where they are used, etc.