I would like to implement kind of a trust-on-first-use (TOFU) scheme with TLS:
- A client creates a key and a self-signed certificate.
- The client connects to the server with this certificate.
- The server accepts the connection and stores something about the client
- Assuming that this first connection was not MITM'd, I want to be able to verify that the next connection comes from the same client.
Is this possible? And if yes, what is that something I have to store from the first connection to be able to verify the second connection?
In practice I am using the Golang TLS library so I think this is the information I have about the connecting certificate.