There are legitimate reasons for having an invalid SSL certificate. If you are a developer and have a development environment that is a copy of a secure environment you may also have a self-certified SSL certificate to simulate the live environment. In the case of IE7 this would warn the user, advise against it, but provide a link to continue anyway or cancel. In the case of Firefox 3.0 they try to deter users more by giving them the option to, then having to confirm and then going through a dialogue box to further accept that you are about to use an invalid certificate. For those who are unsure how to do this I've added an article to help.