REST API communication between two Web Servers - VPN or https?

Question

We have two servers that will be sharing data and communicate over a REST API: our main application server will communicate with the server of our client that is managing some assets.

In short:
Given the infrastructure we are setting up, namely REST API communication between to web servers, is there any reason to prefer VPN over https? What are the main differences between the two solutions?

In more details:

• From a performance point of view, is there significant difference VPN and https ?
• Given that we are talking only via our API, is connecting two computers via VPN not an overkill ?
• If we need to secure communications with other providers, and want to keep each one in a separate network, is https more standard ?

And around here:

here is a very good question with pretty much details about https, and answer in favor of VPN... But I am still unsure about the possibilities to grow "multi providers".

Thanks to shed a light on these areas.

Answer 1

The two would be equally secure assuming you do things right (TLS certificate pinning on one side, and client cert authentication), but I'd prefer the VPN as it's easier to use in the long run.

HTTPS isn't that easy to use - each HTTPS server should have a cert, the app accessing the API endpoints should take care of verifying the authenticity of the remote cert, and present its own client cert. Plus, for each request a new HTTPS connection would be established, that takes time and resources.

On the other hand, the VPN is managed by the kernel itself (I assume we're talking about IPSec) and the connection is always up. Once that's up and running, you can freely use HTTP, without the overhead of establishing a secure tunnel on each request because the IPSec tunnel is always on. As a bonus, you won't need to do anything more if you ever need to use a different (possibly insecure) protocol later on.