title: Why does Chrome hate self-signed certificates so much?
body: <p>I'm running a small web app on an EC2 instance and I want some friends to be able to use it. I also want to make it use HTTPS, just for basic security purposes (prevent packet snooping whenever possible). Of course I am using a self-signed certificate, because my budget for this project is $0. But Chrome throws up a warning page upon trying to visit it:</p>
  <blockquote>
  <p>Your connection is not private</p>
  <p>Attackers might be trying to steal your information from [...]
  (for example, passwords, messages, or credit cards).
  NET::ERR_CERT_AUTHORITY_INVALID</p>
  <p>This server could not prove that it is [...]; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.</p>
  </blockquote>
  <p>Is is not true that &quot;any encryption is better than no encryption&quot;? On unenecrypted HTTP, I could be trying to steal information as well, and don't have to prove anything about my server identity, AND my communication can be read in plaintext by packet sniffing, but Chrome doesn't throw up any warning flags there...</p>
  <p>What gives? Why does Chrome hate self-signed certificates so much? Why doesn't it just put a little red box over the padlock icon, instead of giving me a two-click warning page?</p>
  <p>Edit Sep 2021 (this was applicable since 2016): Just suck it up and use one of the free key issuers. Let's Encrypt and AWS ACM will literally do it for free.</p>