Https server side, as well as client encryption?

Question

I'm new to data-encryption and do not understand the following:

1. I convert my domain into a "https" domain, by means of something like "Lets Encrypt".
2. I have an android app that talks to an api on my domain.
3. Do I still need to perform client side encryption using a public key on the android app -> send the encrypted data to my api -> decrypt it on the server using my private key? What does it mean if my domain is already https? Do I need to distribute public keys to every user who visits my domain? How do I do that?

Answer 1

No, the whole point of TLS is to encrypt the traffic between your app and your server. TLS deals with the key distribution, which would otherwise be a really hard problem. TLS was made exactly to solve your problem. Adding another encryption layer that is essentially the same as TLS does not add any security for your system. It only increases complexity (attack surface).

Make sure your TLS implementation is secure and users cannot bypass it (using legacy HTTP or something). Consider using modern security features like strict transport policy and focus on web security (XSS, CSRF, etc.). Experience shows that most of the time the implementations are insecure, not the crypto.