I'm creating a system that will allow the user to control a certain number of remote hardware devices. Each device (the client) is connected to a micro web server, that responds to HTTP(S) requests.
The client must send data to the server (containing it's current hardware state). The server must send data to the client (to tell the client what to do). Client and server can send data to the counterpart when they want.
Now, I'm concerned about security... How about using HTTPS with self-signed SSL certificate for the client?
Let's assume that I buy a certificate for my domain server (provided by an external trusted CA) and I create a different self signed certificate for each client. Can I benefit from HTTPS security in the two communication directions (client to server and server to client)?
In this case the server will store the different client certificates, so it can establish a secure connection when it want to send a command to the client. Is it right?
The "client" (the hardware device) acts as a server when it receives a command by the remote user. But acts as a client when sends its hardware state to the server. These cases take place in two different moments. So, both parties should be able to connect with the counterpart as client or server depending on the case.