I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site.
I want to give both server and client programs (.jar archives) to my users.
- The SERVER is a mod for a game (has one
- The CLIENT is a smartphone that is supposed to control the game by sending messages to the server (has one
I wanted to keep everything encrypted so I think SSL is a good choice. Because the Server is actually not mine what I did was let the server create a self-signed certificate and store it
Because accepting any certificate can be exploited, e.g. the attacker could spoof the
server-id of another server and my client app would send the internal password (not SSL related) to the attacker.
The attacker could now spoof the
client-id and has control over a game
How should I implement the client so that it verifies and distinguishes servers by their certificate?