As a developer I really like the idea of using OpenSSL to get perfectly good, free, SSL certs. Unfortunately, from all the research/analysis I've done so far, it doesn't look like there is any way to use OpenSSL in such a way that my web users' browsers will trust the certs it generates for me.
It looks like, in order to avoid my users getting nasty warning messages from their browsers (complaining that my OpenSSL-generated certs aren't trusted/verified), I'm going to have to use a major vendor like Trustwave, VeriSign, etc.
I'm wondering if there is such a concept of "public" vs. "private" SSL certs? By that, I mean, I would buy a "public" SSL cert from one of these vendors, and would use that for all communication between my users' browsers and my public-facing HTTP servers. But once a server-side message is consumed, it would communicate with the rest of the back-end using different, "private" (OpenSSL-generated) certificates.
The idea behind this is to keep data moving through my backend using secure transports, but not have to pay for a bazillion different SSL certs.
Is this unheard of or completely unnecessary? Or is this standard practice?
Why would I need that data to be secure between 2 of my own backend servers? I don't know. Probably doesn't need to be, but probably couldn't hurt. Thoughts?