IndyHTTPS and a signing token

[rlebeau]

I know I can generate a self-signed certificate, but doesn't it pop up a message when somebody uses the app?

By default, yes. Anyone can create a self-signed TLS certificate. If the client and server don't both trust the signer then the connection can't be secured. So, if you want to avoid the warning then the client needs to install the root certificate that signed the server's TLS certificate. And vice versa if you want the server to verify the client.

I'll admit ignorance, so do I ask my certificate provider if a TLS certificate comes with my couple hundred dollar token?

I can't answer that.