Let's keep it short:
- On HTTP everyone can listen easily. MITM attacks are no problem.
- On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key owners can listen.
- On HTTPS (non-self-signed -> "trusted by Browser vendor") it's like 2, but the illusion is created that this is far more secure than self-signed, but in the end we have to trust the Browser Vendor to not make mistakes (or being bribed)
For me option 1 is far less secure than 2, still Browsers complain about HTTP not at all, but about self-signed certificates extremly hard: several clicks are needed to establish the connection, otherise they fully block the connection with scary messages. Why is this?
Of course, I know the reason behind certificates: To make sure that the one you are talking to is the one you actually want to talk to. But on HTTP you don't have encryption and you don't have trust. On HTTPS (self-signed) you have at least encryption.
So, shouldn't it be really like the following?
- HTTP triggers the "big fat red error"
- HTTPS + self-signed has a warning icon but works regularly
- HTTPS + "trusted cert" issues no warning at all
What are the reason here?