We have devices (think "Internet of Things") that have a HTTP server installed. Those devices can change their IP and domain name quite frequently (or have no domain name at all). They have a GUID though.
The clients communicating with this HTTP server are not all under our control - they might be common browsers.
Is there a way to use HTTPS in this situation, without forcing the user to either
- Accept an invalid certificate
- Add our own CA to their trust store
- Do something else that seems fishy?
Does the answer change if we have control over the client (an app)?
In the past this was solved by using a server in the internet, to whom both client and device connected, and which forwarded messages.