I am new to security work and I am implementing someone else's design. The design calls for a TCP server with TLS in an environment where there is no DNS - only IPs.
I am working with a typical certificate chain (Self-signed Root cert -> Intermediate cert -> Endpoint cert). The TCP server presents the Endpoint cert to a client which has the public portion of the Intermediate cert pinned in its code. When the client connects, it will check that the Intermediate cert was used to sign the Endpoint cert.
So as I understand it, when the client connects, a key exchange occurs to secure the communication and the client then uses the certificate chain verification to verify that the server really is who it says it is. However, in this scheme, couldn't an impostor just present the certificate after getting it from the real server?
Am I misunderstanding this as a flaw? From my understanding, without DNS names to tie the certificate to, checking the chain (with pinned signed parent certificate or not) is not sufficient. Can anything else be done here?