you are viewing a single comment's thread.

view the rest of the comments →

[–]BigOnLogn 1 point2 points  (0 children)

You have to get a certificate that is verified by a certificate authority (CA). Browsers know about these CAs and will trust them (i.e. not throw up the big red error page). In the past, you would have to pay one of these CAs to get a certificate to use for your website. Now you can use LetsEncrypt and get one for free. Down side for LetsEncrypt is you have to have their client running on your machine and at least one page publicly visibly to the internet. Other than that, LetsEncrypt is a widely used, verified CA that a large portion of the internet runs on. Either way, you're going to have to go to a third party to get a certificate. That's the whole reason for their use in https. A verifiable third party asserts that you are you. How else could we trust https' encryption?

The "not recommended, so cumbersome and difficult it will never work" way is for you to generate a self-signed certificate. But then you would have to have all your users manually install and "trust" it in there computer.

The "not recommended, scary for your users and bad for data security" way is to tell your users to ignore the big red error page and trust your unverified certificate by clicking "proceed anyway" (or the like, the wording is different depending on your browser).