Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am developing a game for Android.

The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database.

I would like to encrypt the data that the client will be transmitting from the app to the web service and I am just wondering what type of SSL certificate I will need for that.

share|improve this question

3 Answers 3

You are not communicating directly with MySQL, you're communicating with REST server (presumably over HTTPS), and therefore need an SSL certificate, not for MySQL, but for your REST API.

If the REST service is your own, then you need to make it SSL-enabled by installing a certificate on the web server that runs it. If it's run by someone else, then they need to do so.

And if it's your service, and only used by your client, then you can (and probably should if you know how) create your own SSL CA to sign the associated certificate, and then code your application to only trust certificates that you sign. This would mean that you don't need to purchase certificates and also means that you can't fall victim to any sort of SSL MITM attack. Bear in mind that you should only go down this route if you really know what you're doing. Otherwise, just purchase a domain-validated certificate like everyone else does.

share|improve this answer
2  
+1 for suggesting a self-signed solution –  that guy from over there Oct 21 '13 at 9:15

The SSL-Cert must be valid for your REST - API and has got nothing to do with MySQL.

just order/create your cert, include it into the server/service that provides your API and you're done.

share|improve this answer

If you are going to use self-signed certificate, then it will cause security problems as self-signed certificates create issues of compatibility on web browsers, OS servers, and mobile devices.

I highly recommend that you use third-party Certificate Authority (CA's) to protect your data on the internet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.