I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored on the clientside. I know this is not true and traditional HTTPS, let's just say for argument this has to occur.
I have a client that tries to send my server a payload over HTTPS post. During the handshake, I check the CA of the server and proceed to send the payload if it validates. I don't care if the server rejects the request or not, the client just fires and forgets once handshaked. The client rejects ALL CAs except the one trusted CA.
Is it possible for someone to see the payload the client sends in this scenario besides my server? Say for example I send the request to an IP over HTTPS thinking it is the server I want, but it's actually someone malicious. Is there anyway they can spoof or pretend to be the actual server and accept the request in order to look at the payload of the POST? In order to get the payload, they have to be able to say "I am the server and have a cert signed by the CA you trust" is my understanding. But how can you do that unless you have both the server's cert and the CA? Where does the private key of the server's cert factor in?
If yes, what if I use a CA only the server and client know about like a self signing authority? Does that change anything, if not why?