I want to distribute a small application that offers a web interface intended for local use. It will therefore bind to loopback only, but there is a chance that someone will want to use it on a virtual or real network interface.
At least then, the arising traffic becomes subject to eavesdropping.
I guess I can’t burden the user with the job of generating and installing a HTTPS certificate/key, so my question: Is there a way of establishing an encrypted connection with a standard browser without such certificate/key on the server side, abstaining from server authentication?
Without SSL and a certificate, you will have to build your own authentication and encryption protocol, which isn’t trivial. It’s possible to use a self-signed SSL certificate on your web server so that you can use any domain name you want, problem is it requires each client to trust that certificate (by importing it to the machine). In enterprise environment there is also IPSec which protects all traffic.