1

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP Address)

Do I need to purchase a CA signed Certificates, or does a self signed certificate will be enough for security ?

4

Self signing would give you the benefits of encryption, but would not give the assurance that your clients were connecting to your server as it is not verifiable by a Certificate Authority.

Self signing the server against its IP address would put you at risk of IP hijacking. Using IP instead of domain name takes DNS spoofing out of the equation, but does not entirely remove the threat of MITM attacks, therefore you should not use IP match as the only validation mechanism.

It would be better to get a domain and a cheap domain validated certificate (DV Certificate) and make sure that clients are validating the Subject Alternative Name for a match during the handshake.

As well as the security benefits, this will also give you the convenience and portability in future if you ever need to relocate the server.

The exception to this is if you have total control over your client applications. Then you could use a self signed certificate and you could employ certificate pinning to ensure that it is your server that they are connecting to.

4
  • Tank you for your answer. Actually I do have a total control over the client application, so certificate pinning is an option! About the portability, that's a none issue for me. So you confirm that if certificate pinning is possible, then no need a CA Certs to get a flawless security ?
    – TheSquad
    Dec 21 '14 at 17:12
  • You may want to mention that DNS vs. directly connecting to an IP is irrelevant to certificate signatures, because man-in-the-middle attacks that certificate signatures protect against can happen if you're connecting directly to an IP just as much as they can happen if you use DNS.
    – cpast
    Dec 21 '14 at 17:12
  • @TheSquad: Yes, if your client applications are validating the certificate directly then they do not need to follow the certificate chain to a trusted root CA. Dec 21 '14 at 17:19
  • "flawless security" - No!! Please don't ever think that! If you really need high security, then TLS will only be one of the steps. It's main purpose is to secure communications traffic between client and server (data in transit). It's secondary purpose can be to authenticate the server to the client. It is possible to add client authentication using the same type of process (e.g. SASL). But TLS still has known flaws & is subject to configuration errors, unwise to just rely on it. Dec 22 '14 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.