I am fairly new to encryption and I need some help. I have a problem that I'm trying to solve.
My problem is the following:
- I have a Web Server and an (iOS) App that that communicate with each other.
- I want the communication to be secure, so I'm using HTTPS.
- The Web Server and the App are communicating via an intranet, with no access to the internet on either end.
- Since there is no connection to the internet, the SSL Certificate on the Web Server is self signed, and cannot be verified against a CA.
So my problem is that when I establish an HTTPS connection, the Certificate cannot be trusted because it can't be verified, so MITM attacks are possible. So what I need is a way to verify the Certificate without resorting to a CA.
My idea is to start by establishing a secure connection between the App and the Web Server using Diffie-Hellman to transfer the certificate, so that when the SSL connection is being established, I can verify if the certificate is correct.
Would this work? Or is it somehow still susceptible to MITM or other attacks? If it is, then how else can I solve my problem?
Also, it's worth mentioning that each of my customers will have their own Web Server and therefore their own self-signed certificates. So embedding the public key into the App is not an option.