Indeed, I don't recall atm which one Amazon used for their SSL offerings (which are coupled to AWS iirc), but they used the same approach (while also going through the normal channels).