I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using OpenSSL API function SSL_CTX_load_verify_locations to load a .pem file containing public root certificates to verify that the server is a trusted server...I think!?
I've done LOADS of searching but I can't find a simple description of what I'm meant to do to make sure I am talking to a Google server. Is using a .pem file with root CA's the correct thing to do? How do I know I'm talking to Google and not someone else on the trusted list?
Also, am I meant to distribute the .pem file along with the application, or can it be compiled into my application?
Any help greatly appreciated.