Or ssl web site is accessed in 2 ways: 1) using web-browsers 2) using our client application
We want to bundle the client app with our own CA certificate (not trusted by browsers), in order to be 100% sure, that no one can access the encrypted data. (Even ones who operate trusted Intermediate CA). We want our app to trust only certificates signed by our CA.
And, of course, we want this site to open in browsers without warnings.
So, is there any way to put 2 certificates on single host, port and domain, one that is trusted by our app, and another trusted by the browsers?
We can use a different host for app access, but out management do not want to take a risk of bad PR attacks against us targeted to semi-educated IT community (Imagine a publication, when someone points to our server and says "Ha-ha, they use a free self-signed certificate, they are so unsecure.")