Pardon me for my complete ignorance(even after reading a lot on this) but would like to get community's view on following questions:
While I know for 2-way SSL authentication, we need to generate certificate(self signed/CA signed depending upon requirement). My question is little broader- why we as Salesforce customer, need to generate/upload and provide certificate(s)? Salesforce supports Https/TLS, Why Salesforce certificates are not sufficient and we need to upload/generate our own certificates
Is it because our domain(*.my.salesforce.com) is subdomain and Salesforce mightn't have paid for subdomains while buying certificates from CA? Is same argument valid for communities custom domain which can be completely different.
Why for outbound message/Ajax proxy, we just need to generate API client certificate provided by salesforce itself and it is not something we've to purchase. Why same functionality can't be extended to other functionalities(Salesforce as Idp/ web service call outs etc)?