A certificate from a well-known root CA will be automatically trusted by most clients, meaning they don't have to click past warnings and/or download your local certificate manually when connecting. Cisco doesn't sell certificates as they don't operate a public root CA. Any number of vendors offer this service though (Entrust, GoDaddy, Thawte, Verisign, etc.).
Creating your own requires a bit more configuration know-how and usually entails having your clients either always click past the warnings or else manually install your local signed certificate into their trusted certificate store - generally regarded as burdensome by most end users and potentially inspiring many more calls to your IT staff or help desk.
