The current bounty system is broken. I ran into the issue listed in this question: http://serverfault.com/questions/180085/can-ms-certificate-services-be-a-subordinate-to-ca-created-with-openssl The only answer was *"you are using the wrong tool for the job"*. I know that's not a true statement, so I created a bounty hoping someone would come along and give a better answer. Now I get an e-mail from serverfault saying that my bounty will be automatically awarded. Problems: 1. The bounty is being auto-awarded to the dipsh*t who said openssl isn't the correct tool for signing certificates. 2. There are no other answers (valid or not) 3. I can't 'retract' my bounty 4. Why can't a bounty stay open indefinitely until someone actually answers the question? Especially if the asker hasn't marked any answer. 5. I don't care that 4 other people up-voted the answer--it's still a bad answer.