and aquire a site certificate from some place like VeriSign or Thawte
However, if your users are all well-known to you (and vice-versa) you can probably dispense with with certificate and just generate your own standalone certificate. All the the certificate authorities really are guaranteeing is that "you" are approximately who you claim to be.