[cmelbye]

The certificates are unverified by a trusted certificate authority, so anyone can perform a man-in-the-middle attack by providing a different certificate to clients, allowing the bad guy to decrypt the information.

(edit: clarified wording)

[Sephr]

It wouldn't be like that if you're using a self-signed cert.