It's still encrypted, it's just not "trusted".  I usually do this to ssl encrypt a site, but don't care about the cert popup.

If it's something you control the clients (think enterprise AD environment), you can always self-sign a ca, push the ca cert to clients as a trusted ca (ie. windoze gpo auto-enroll push for cert distribution), and you shouldn't get that anymore assuming the CN's are valid.  Or just make everyone using it install the CA cert as "trusted", even with a self-signed CA cert.  I have a quickie openssl recipe to create, see below (for ubuntu, dir's may change for dists):

This is normally now an enterprise cert infrastructure is done, specifically NOT using external trusts for internal applications, eap for wired/wireless authentication/encryption, or whatever use.

#########
## 2) setup openssl for ca generation of certs for ssl

cd /etc/ssl

sudo vi openssl.cnf

## see appendix for details on what to change
#################################################
## notable changes to /etc/ssl/openssl.cnf

[ CA_default ]

dir             = /etc/ssl        # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt        # database index file.
#unique_subject = no                    # Set to 'no' to allow creation of
                                        # several ctificates with same subject.
new_certs_dir   = $dir/newcerts         # default place for new certs.

certificate     = $dir/certs/ca.local.pem    # The CA certificate
serial          = $dir/serial           # The current serial number
crlnumber       = $dir/crlnumber        # the current crl number
                                        # must be commented out to leavea V1 CRL
crl             = $dir/crl.pem          # The current CRL
private_key     = $dir/private/ca.local.key    # The private key
RANDFILE        = $dir/private/.rand    # private random number file

x509_extensions = usr_cert              # The extentions to add to the cert

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = US
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = $STATE$

localityName                    = Locality Name (eg, city)
localityName_default            = $SNMPLOCATION$

0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = Company Organization, Inc.

organizationalUnitName          = Your Organizational Unit Name
organizationalUnitName_default  = Network Planning & Engineering

commonName                      = Common Name (eg, YOUR name)
commonName_max                  = 64

emailAddress                    = Your Email Address
emailAddress_default            = $SNMPCONTACT$
emailAddress_max                = 64

#################################################
## note: find/replace local your dns extension to the host
## find/replace ca01 and netmon01 as appropriate

sudo openssl req -new -x509 -extensions v3_ca -keyout ./private/ca.local.key -out ./certs/ca.local.pem -days 1461 -config ./openssl.cnf
sudo openssl req -new -nodes -out ./certs/$HOSTNAME$.$DOMAIN$.csr -keyout ./private/$HOSTNAME$.$DOMAIN$.key -config ./openssl.cnf
sudo mkdir newcerts
sudo touch index.txt
sudo vi ./serial
## add to file "100001"
sudo openssl ca -out ./certs/$HOSTNAME$.$DOMAIN$.crt -config ./openssl.cnf -infiles ./certs/$HOSTNAME$.$DOMAIN$.csr
sudo su -
cd /etc/ssl/private
openssl rsa -in $HOSTNAME$.$DOMAIN$.key -out $HOSTNAME$.$DOMAIN$-clear.key
exit

-mb


On 03/13/2014 11:03 AM, Mark Phillips wrote: