Has anyone changed out the self signed cert for one from DigiCert, Thawte, or another cert company?

I've run into a snag getting a proper Subject Alternative Name Cert from DigiCert.  Turns out none of the big cert companies will create a SAN cert that uses internal only IP addresses 10.x.x.x, 172.16.x.x. or 192.168.x.x.  They all got together back in 2011 and agreed not to do it for security reasons.  

I think this might only affect PowerVC 2.1 from what I can see.  I did use our wildcard cert back with 2.0.0 and it worked then.  Seems the re-work to 2.1 has internal services using HTTPS URLs with the IP address for verifying things.  Those services fail when I try using our wildcard cert now.  Even the IBM docs state that you need a SAN cert that lists the IP addresses.

Seeing that the URLs are built during installation or re-built when the IP changes, they must be stored someplace in config files.  Shouldn't be any reason not to store the FQDN instead.  

Seeing that the Security Department here has plans by end of the year to require only publicly verifiable certificates be used, I'm under the gun to get this fixed up.

Has anyone changed out the self signed cert for one from DigiCert, Thawte, or another cert company?

I've run into a snag getting a proper Subject Alternative Name Cert from DigiCert.  Turns out none of the big cert companies will create a SAN cert that uses internal only IP addresses 10.x.x.x, 172.16.x.x. or 192.168.x.x.  They all got together back in 2011 and agreed not to do it for security reasons.  

I think this might only affect PowerVC 2.1 from what I can see.  I did use our wildcard cert back with 2.0.0 and it worked then.  Seems the re-work to 2.1 has internal services using HTTPS URLs with the IP address for verifying things.  Those services fail when I try using our wildcard cert now.  Even the IBM docs state that you need a SAN cert that lists the IP addresses.

Seeing that the URLs are built during installation or re-built when the IP changes, they must be stored someplace in config files.  Shouldn't be any reason not to store the FQDN instead.  

Seeing that the Security Department here has plans by end of the year to require only publicly verifiable certificates be used, I'm under the gun to get this fixed up.