[Sae5waip]

For internal websites, be your own CA and distribute the cert via AD (or include it in your OS image, or whatever).

[VLM]

In the spirit of "idiot proofing leads to better idiots" of course that will not happen.

In fairness if you have a heterogeneous network of legacy windows, some macs for real work, legacy blackberry and both real smartphones, distributing it "everywhere" can get kinda hard.