I'm creating an application with a client-server architecture using SSL via TCP. Clients can authorize themselves on the server using login and password and become users. Only users can perform any actions with their accounts. Unauthorized clients can only authorize themselves.
Now clients only with my client app using my server, but I think it will be ok if somebody will use third-party app.
As I understood, now only my server authorize itself for the each client, so each client know that this is a real server. Server test command:
openssl s_server -key server.key -cert server.crt -accept 1678
On the client side I have only
So, the questions:
- Is this understanding correct?
- Do I also need a client side keys for clients authorizations on the server, or this is enough for described architecture?
- Do I need a CA cerificate or self-signed certificate will be the same?