You are free to generate your own SSL certificate. Just be aware that your users will get a big scary warning message saying the certificate can't be verified. This will trouble many users. Some may just leave, or call your support line, both of which can cost you money.
SSL certificates have two purposes:
- To enable encryption
- To verify that the person you think you are talking to actually is that person.
A self signed certificate only accomplishes the first purpose, unless you have a way for people verify the certificate, like giving them a copy of the public half in person so they can add it to their trusted certificates store.
The verifying part ensures that, for example, I didn't generate a certificate with your website's name, then hijack your customer's DNS or network connection, and direct them to my server. In theory, Verisign/Godaddy/Whoever won't give me a certificate for your website.
For internal sites, or small ones where you can easily get your users to install a certificate, a self signed one works fine. For a public facing site, it's pretty much unacceptable. Even though it enables encryption, it doesn't prove you are who you say you are. And it throws up a BIG SCARY error message. That alone is reason enough to pay the few bucks for a valid trusted certificate.
As for extended validation certificates - there is no way to make your own. The browsers have a very specific list of which root certificates are allowed to have extended validation, and that usually isn't user configurable. Short of reprogramming, compiling and distributing your own copy of chrome or firefox, it's not going to be a free option.