> self-signed cert for all the people who can access the admin.

This is what I do. The browser generates a warning on first use, and I then put the domain in the "ignore" list (since I trust my own domain). After that, it works fine.