tptacek explained to me once how using a self-signed certificate (or more to the point, trusting it) is a bad idea: http://news.ycombinator.com/item?id=2376644

tptacek explained to me once how using a self-signed certificate (or more to the point, trusting it) is a bad idea: http://news.ycombinator.com/item?id=2376644 http://news.ycombinator.com/item?id=2376644 You can get free certificates backed by a CA trusted by most browsers, for example at https://www.startssl.com https://www.startssl.com. There are some limitations (e.g. no wildcard certificates) but it's still much better than a self-signed one.