Lets assume there is a server and a client and you want to connect those two. Server has a self-signed certificate, and prior to establishing the connection for the first time (enrollment) the server creates a client-certificate, and a one-time-password for the specific client. (initiated on server)
The admin has both machines in front of him, and then types the one-time-password into the client (assume secure transportation of the token to the client). The client then connects to the server (https) and on success, it identifies with the one-time-password. The server then sends the client-certificate to the client.
The insecurity is in the moment of the first connection. As the client does not know the certificate of the server (and it is selfsigned), someone could hijack the connection and redirect the client to a "bad server" and send the one-time-password to that one without even knowing. (Intranet should be most likely fine, the real danger is when this is done over the internet)
There is a way to fix this completely: not only give the client a one-time-password, but also the fingerprint of the server-certificate. Unfortunately this cannot be done in this scenario, and I can only transfer 4 to maybe 6 or 8 byte for the purpose of validating the certificate.
I know this does not establish complete security, but I guess it is better than no check , right? How easy would it be for an attacker, to create a certificate that has the right url and matches .. say the first 4-8 characters of the fingerprint. Is the is there a way to get it more secure with only 4-8 byte?