If you want to use https you'll need an SSL certificate. Without it your visitors will get a warning from their web browser. It is common for SSL encryption (machines between the visitors machine and the server cannot see what is being sent on the connection) to work once they accept the certificate, but there is no protection again man-in-the-middle attacks (a machine in the middle pretenting to be your server). Probably not a significant worry for the majority of users, but seeing the warning message may put them off using https.