I have deployment that includes a public asp.net
website and an internal webAPI both installed on the same machine.
The webAPI will only communicate with the website. For example, it will not be exposed to the Internet, but is internal and will not be accessed by other machines.
I think to pass a pen. test, the communication between the website and webAPI may have to be HTTPS (I believe this has been raised in previous tests). In this scenario, is it ok use a self-signed cert, for example the one I create?