Well, public nodes that accept new users should have a vanilla certificate for web subscription.

But for individual nodes it should be enough a free certificate confirmed by the internal pump.io CA tree.