title: Are self-signed SSL certs really inapplicable with Phonegap client apps?
body: <p>The question addresses two fields: SSL certificates in general and Phonegap/Cordova related capabilities.</p>
  
  <p>At first let me briefly describe our case: we're creating a simple system consisting of a mobile app written in Phonegap (a client) and a HTTP(S) server with a RESTful API. Some confidential data should be transfered back and forth. The client should be authenticated with two-legged OAuth as well.</p>
  
  <p>The system is closed, i.e. we're not planning to expand it to more than that single desktop app, it's about to be configured once and work continuously.</p>
  
  <p>From some reasons, however, we can't put these things in a closed network to use just pure HTTP.</p>
  
  <p>So, I guess, HTTPS is the only way.</p>
  
  <p>Now, the problem:</p>
  
  <ol>
  <li><p><a href="http://docs.phonegap.com/en/4.0.0/guide_appdev_security_index.md.html" rel="nofollow noreferrer">The Phonegap's Security Guide</a> states that there is no point in using
  HTTPS if it uses self-signed certificate as opposed to one issued by
  a CA.</p></li>
  <li><p>On the other hand, <a href="https://stackoverflow.com/a/514243/858590">Clint Harris explains in his answer</a> that
  self-signed certs are perfectly valid, if we distribute them on our
  own.</p></li>
  <li><p>One additional problem is that Phonegap won't allow you to perform
  such AJAX calls to the RESTful API via HTTPS - the only way is to
  enable the debug mode or simply hack it.</p></li>
  </ol>
  
  <p>That's why we're totally confused. </p>
  
  <p>After all, which approach - 1 or 2 - is valid/applicable in our <em>closed-system</em> case and how can we solve the last (3) problem? Also, any additional explanation would be appreciated.</p>