I am currently working on a security-based product (VPN) and we have one critical requirement that I am unable to figure out.
The connection between the User and the VPN server is based on the OTP (One-time Pad) algorithm and I also have SSL on the server.
At the SSL handshake level, the certificate is sent over to client for verification. But we wish to encrypt the certificate as well using OTP before it is sent over the network.
The client is an iOS app. I am also looking for a solution so that the OTP encrypted certificate is first validated at the device level, before it is validated by the SSL handhshake. It is an additional security level that we wish to integrate.
Any idea how can I do this? As far as I know, the SSL handshake is an automated process and cannot be controlled.