Let's say a web server would like to host traffic over
HTTPS. My incomplete understanding is that
client <--- HTTPS (over TLS) ---> server
The server must produce a certificate to present to the client, who then must trust it to proceed the
HTTPS communication. The server has 2 options to get a certificate:
- Buy a certificate from a "Trusted Certificate Authority"
- Create a certificate
In the first case, as I understand, the client's run-time, e.g. Java's JRE, will trust the certificate.
However, in the second case, as I understand, the client must add the "certificate" to their "trust store."
Assuming the above is partially correct, why would a company choose the second option, i.e. produce their own certificate?