Should I use a Public Certificate Author

I have a scenario where a client has a Web Server in his network that has to be accessed from the Internet by external employees. The communication needs to be secure but should I tell them to dish out the $900 or so that it takes to get a Web Certificate from Verisign or just look at implementing Windows 2000 Certificates?