2

I'd like your advice on what is the best approach for the challenge in my hands...

I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end results needs to be a WebSockets Server that supports encrypted/secure communications. The users will receive this extension and will install it on their machines thus can be 'any' hostname, IP, etc - not known in advance.

The (WebSocket) client of this software extension is an iOS app (using SocketRocket) that requires the user to provide the IP and Port of their installation to connect to. The iOS app comes from the Apple app store so it is not customised per user.

In this scenario what is the best way to make this connection between the iOS app (websocket client) and the software extension (websocket server) secure/encrypted?

Initially I thought certificates, having wss forced connections on the WebSocket Server but this requires each user to create their own certificate and I don't know if the iOS device will 'accept' it and 'use' it?

I thought about changing the architecture and having a middle tier, making the extension a websocket client thus having a single point of contact, this idea was rejected.

Any alternatives I should consider?

Thanks!

1 Answer 1

0

You could generate a certificate on first run and then use certificate/public key pinning within the app to verify that it is connecting to the right server.

This will enable you to use HTTPS over SSL/TLS. Apparently lots of existing apps use self-signed certificates. You could perhaps display the details of the certificate it receives of the first connection to allow the user to verify it is the one just created on their WebSocket server - once accepted, the public key is stored in the app and only certificates with the stored public key will be accepted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .