No excuse for that other than pure laziness which would make me wonder what corners are they cutting on the hard stuff?
Especially when you have solutions like
https://letsencrypt.org
I'd be rethinking my relationship with this vendor and if you are in a position to dictate you should be squeezing their balls real hard.