I have seen similar questions and answers, but none really answer my question effectively.
There are 2 problems that SSL answers: Encryption and trust.
Time for a truth table:
| Encrypted | Trusted |
------------------------|-----------|---------|
No certificate | No | No |
Self-signed certificate | Yes | No |
CA verified certificate | Yes | Yes |
Based on this table, why exactly do browsers give me a huge scary red warning telling me that a self-signed certificate is dangerous, when clearly it is safer than an unencrypted connection?
An answer I've seen to a similar question, is that self-signed certificates aren't trusted. That's fair enough, but then why don't I get a huge scary red warning telling that an unencrypted connection is dangerous?
Am I missing something? Can self-signed certificates be compromised in some way that CA verified ones can't?
This crops up a lot for me. An example: I set up a system to be used internally by staff, both office based and on their own computers. I don't care if they trust the certificate, all I'm concerned about is that the connection is encrypted. This is fine in the office as I can remotely roll out the self-signed certificate onto the computers to trust, but I can't do this on computers that belong to the employees or those out on the field.