We have a licensing system where our software, a commercial product we sell to people, contacts our licensing server when starting to get an OK to run.
It contacts our licensing URL and passes up an XML file signed with our public key. We verify the signing with our private key, build an XML file to send back, and sign it with our private key. The app then uses the public key to verify that it cam from us and acts on the response.
We're looking at allowing the URL and public key to be overridden with values set in the app's config. Overriding the URL would be used for letting customers test our new license server. Overriding the public key is to handle the case where our private key becomes known and we have to change it.
However, it strikes me that someone could override both to have it point to their server using their public key and they've now given everyone the ability to bypass our check.
Is this a hole in the system? And if so, is it a bad idea to allow either to be overridden? If we can safely override either one, but just one, I think the public key is the one to allow setting in the config file.
Or is there another way to go about all this?