1) Regarding the software:
a) I've read good stuff about Atmail
but I haven't used them personally.
b) Rent some web/email space from a good known provider and call it a day. This is the option that I would choose.
c) Rent a small VM and run CPanel
on it. It integrates the Roundcube
webmail client and you can tweak... to much stuff. CPanel's used by webhosting companies (including yours truly at my afternoon gig). However, this may be overkill.
2) Regarding the SSL certificate: a self-signed one is technically sufficient but dangerous as it allows for man-in-the-middle attacks. And all client programs and browsers will complain about it. Seeing as a proper SSL certificate can be obtained for as low as $25/year, it's a no-brainer.
Do consider the following before you decide to host e-mail yourself: you will be in support hell. Trust me. There is almost nothing so difficult to support in this world like e-mail. You will spend a lot of your time fighting spam, which will be your #1 headache, getting complaints about "we don't get messages from these guys" (because their IP is an RBL, or their DNS is misconfigured, or the person made a typo), getting complaints about "those guys don't get our e-mails" (because your user made a typo, because you are in an RBL, because their spam filtering software is way too aggressive), getting complaints about how there's something wrong with the server every time that one of your users doesn't have an internet connection. You only have to handle 5 accounts, which is quite different from the ~1500 I have to deal with, but still.
You will also need a static IP and an rDNS entry, and preferably set up SPF records for your MX entries.
Yes, I do this kind of thing for a living and I would just rent web/e-mail hosting from somewhere and call it a day.