My question is based on to secure REST API's. We have to publish a REST API and we want only certain consumers to consume the API. I was thinking of one way is to use asymmetric encryption.
The steps I was about to follow:
- Generate a public/private key pair
- Export the public key in the form of X.509 certificate
- Share the public key with the client
- Client to use public key to encrypt data and make a POST Request on the API to send the encrypted data
- On the server, I'll decrypt the data using my private key and then store in the database
If an SSL certificate is already installed on the webserver and any API has to be called using HTTPS, is it not doing the same thing as per above?
That is where my confusion lies. Can someone help?