It's a dumb move from browser makers (self-signed certificates really shouldn't be the same kind of error as outright fraud). Maybe they can get the Kazakh root certificate incorporated into major browsers? But until then what other approach is possible to bootstrap it? There are obvious reasons the Kazakh government infrastructure wouldn't want to be dependent on e.g. Verisign.
>They issued their own root certificate and they use it to sign all users certificates.
In our case I think we even have our own CA trusted by the browsers so there's no apparent reason for the self-signing.
>If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.
That's precisely the point I made to the "technical" person and it was ignored...
Not very smart move if you ask me. If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.