I am attempting to purchase a standard (non-EV) SSL Certificate for an internal application (Oracle Hyperion) that we have made available over our organization's WAN. The application is not accessible from the internet.
The company from whom we are attempting to purchase this cert has told us they cannot issue the cert without being able to access the application (website) and "review it".
I am curious to know if this is standard practice with SSL certs? I've not encountered this kind of issue in the past and I know I've ordered certs for non internet-facing websites before.