I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate with the server.
My cert is self signed.
I have a specific requirement for the client: It only has knowledge of the server certificate or CA. It doesn't know about any other public CAs or certificates. The client is only meant to talk to the server, it will reject anything else.
When the server's certificate expires, I need to renew it. However, I would prefer not to have to update the client. What are my options?
- I could have the client ignore the server's expiration date, and not have to renew the cert regularly. Not my favorite option.
- Could generate the server cert to be an expiration date in the year 9999. However, again, I'd like to rotate the cert if possible.
- If I make a CA and inform the client of the CA, it allows the server cert to be changed whenever. However, CAs expire too and if I need to update the CA, then I have to update the client.
- I was looking at HPKP but I do not believe my server & client supports this. If this is the most optimal route in my scenario, I could spend time implementing it on both ends.
Any other ideas I may be missing? I know that if you reuse the same private key and csr, the public key doesn't change. However, just having the same public key seems insufficient for completing the handshake unless I'm mistaken.