I've got a Magento installation on a server. I have been contemplating getting a certificate for my site. However, since all of the credit card and other payment options are being processed offline, do I really need it? After all I can still connect via an encrypted channel to the remote Magento installation on the server (using HTTPS). The only problem I see is that such encryption connection is still subject to impersonation from an attacker mimicking the remote host, so when I access the admin panel of course such an attacker could steal my password. However, I doubt this is a likely scenario, especially since there are also many other e-commerce sites out there, and most importantly, since customers do not need to access the admin panel and don't need a secure channel for browsing products and adding them to their shopping cart but only need such a channel at checkout time, and such channel is provided by the gateway service provider, I don't need to install one myself.
Would like to hear opinions on this matter. I've read that SSL certificates make the client more secure, but then again they will not be seeing the lock icon in the URL if they are just connecting with plain vanilla HTTP.