5

We have two servers that will be sharing data and communicate over a REST API: our main application server will communicate with the server of our client that is managing some assets.

In short:
Given the infrastructure we are setting up, namely REST API communication between to web servers, is there any reason to prefer VPN over https? What are the main differences between the two solutions?

In more details:

  • From a performance point of view, is there significant difference VPN and https ?
  • Given that we are talking only via our API, is connecting two computers via VPN not an overkill ?
  • If we need to secure communications with other providers, and want to keep each one in a separate network, is https more standard ?

And around here:

here is a very good question with pretty much details about https, and answer in favor of VPN... But I am still unsure about the possibilities to grow "multi providers".

Thanks to shed a light on these areas.

Improve this question
3
  • 1
    Please narrow down the scope of your post. As it stands, there are too many questions.
    – Deer Hunter
    Apr 15, 2015 at 8:53
  • @DeerHunter - I got it down to three questions. Does it look ok ?
    – mika
    Apr 15, 2015 at 9:19
  • Upvoted, looks ok.
    – Deer Hunter
    Apr 15, 2015 at 10:06

1 Answer 1

Reset to default
3

The two would be equally secure assuming you do things right (TLS certificate pinning on one side, and client cert authentication), but I'd prefer the VPN as it's easier to use in the long run.

HTTPS isn't that easy to use - each HTTPS server should have a cert, the app accessing the API endpoints should take care of verifying the authenticity of the remote cert, and present its own client cert. Plus, for each request a new HTTPS connection would be established, that takes time and resources.

On the other hand, the VPN is managed by the kernel itself (I assume we're talking about IPSec) and the connection is always up. Once that's up and running, you can freely use HTTP, without the overhead of establishing a secure tunnel on each request because the IPSec tunnel is always on. As a bonus, you won't need to do anything more if you ever need to use a different (possibly insecure) protocol later on.

Improve this answer
1
  • 1
    This assumes you have control of the network between both endpoints. HTTPS would be preferred in environments where you cannot guarantee IPsec protocol reachability between both points.
    – Brandon Galbraith
    Oct 17, 2016 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .