I'm operating several NAS devices on my employer's LAN. I do so with the employer's blessing, but I do not have control over the domain, and the devices are only available to a small working group on the LAN, and not accessible from outside the WAN (without a VPN, that is). They do have access to the internet, though, to obtain firmware updates.
I'm using https for the web interface (via non-standard port), which I use for administration, but which is also used by users to set their passwords and for some use cases, though most users use SMB or SFTP for access to their data. The devices come with a pre-installed, untrusted https certificate from Synology.
Is there a generally recommended way to deal with the fact that browsers complain about the untrusted certificates? The options, as far as I'm aware so far, are:
Create an exception
Every user needs to create an exception for each of the devices in their browser, on every device from which they would be connecting to them. I'm not completely sure how secure this would be. Does it mean that the browser will always accept any certificate for the given machine, or accept the same certificate from any machine, or will the exception only apply for the particular combination of certificate/device? And how smart is it to use the preinstalled manufacturer's certificate?
Generate my own certificate
Let's Encrypt is usually recommended to get a clean, valid certificate, but they require that I demonstrate control over some domain, so that's not going to work, as far as I can tell.
Will a self-signed certificate be okay? Would it be overkill to do as Mircea Vutcovici suggests here and make my own CA etc..?
I'm generally confused about the level of security which the different ways of proceeding would offer me. The NAS devices contain data which should not be available to most people on the LAN, but nothing we wouldn't be allowed to also store locally on our office computers, so we don't need crazy levels of security, but I'd like to be sure I'm not doing something stupid. Most users have little knowledge about network security, so getting all of them to install a custom certificate would likely cause a bunch of support questions -- but I'd probably bite that bullet if needed.