Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)?
I am some what torn on how to do this - I have a number of implementaiton thoughts.
On the one hand, I can redirect any incoming http request to an https landing page that explains the need for a one time exception or to install a "trusted" root cert and provide a button to continue to the requested page as https.
However, that seems a bit hokey. My other thought was just to have a security icon of some type on all the web pages, clicking on that would give more or less the same info and suggest the user in the future use https for connection.
There is no e-commerce involved so https is not critical in that sense. Though I personally would prefer to only offer secure connections, I now think it might be better to leave it up to the end user to decide. Either way, I felt it better to explain the dire unsafe certificate warning before any redirections.
Would like your thoughts on this, I'm sure some have gone through this already.