I have a system which is not connected to the public network. This system is used to open doors inside a building. It spans a open Wifi network where users can open a specific website and enter credentials to open the doors. A TLS certificate is used to secure the connection between the website and the browser. I have no control over endend user machines. Most probably they connect with Android devices (some also have iPhones or normal PCs). Now the old certificate expires and I'm thinking what the best future-proof solution could be:
- Certificate from Startcom CA: This is the existing solution we had. However several browsers don't trust this CA anymore. So I'd expect that several users won't get easy access to the website.
- Certificate from Let's Encrypt CA: This would require someone to retrieve the certificate, physically go to the hardware and change the certificate. This seems very error-prone. It quite some effort to do this and I expect that people forget this.
- Certificate from CAcert CA: This could be one possible solution. Here we would have to teach users how to import the CAcert root certificate and this would work.
- Buying a certificate from a CA: This is also a possible solution, but the organisation is quite small and can't effort to pay this amounts of money to get a certificate.
- Making a self-signed certificate: This is also doable, but I don't know how browsers will handle those kinds of certificates in the future.
So what is your recommendation? What kind of certificate would you recommend and what is the best in terms of user experience?