Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back.
First, if my server connects to paypal using SSL, will it guarantee that there'll be no man in the middle attacks, such as someone sending the fake IPN commands, and intercepting my IPN verification messages and sending a fake VERIFIED message?
Second, would having my own SSL certificate help in security in any way? They're not that expensive, but just wondering what their actual significance is. I suppose it might be useful for getting that green bar in the users' browser at any rate.