My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. I'm guessing the trust you're getting is a way to show you're not a phishing website or something (even though I've seen very convincing SSL certificates on phishing websites).
Anyway, I have an API which just needs encrypted communication between a client and web server. I don't need the trust factor that $200-per-year certificates offer, because users aren't even using a web browser to use my API - they're using some code they've written themselves and the URL is hard-coded into their applications.
Unfortunately working with SSL certificates is tricky for most new developers (whom will be using my API) if the certificate is self-signed. Most programming frameworks will throw an exception if the untrusted certificate isn't imported, etc. It's too annoying and will drive developers away from my service. However, not encrypting traffic is just not an option.
All I need is for web traffic to be encrypted and for developers who use my API to not have to jump through hoops. The mechanism for doing encryption is free and open source, and I don't want to have to buy added 3-rd party "trust".
TLDR / Conclusion: Is there any way to generate a free SSL certificate that will be trusted by most programming frameworks? OR, are there any other options for secure communication over HTTP without a purchased SSL certificate?