I'd like your advice on what is the best approach for the challenge in my hands...
I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end results needs to be a WebSockets Server that supports encrypted/secure communications. The users will receive this extension and will install it on their machines thus can be 'any' hostname, IP, etc - not known in advance.
The (WebSocket) client of this software extension is an iOS app (using SocketRocket) that requires the user to provide the IP and Port of their installation to connect to. The iOS app comes from the Apple app store so it is not customised per user.
In this scenario what is the best way to make this connection between the iOS app (websocket client) and the software extension (websocket server) secure/encrypted?
Initially I thought certificates, having wss forced connections on the WebSocket Server but this requires each user to create their own certificate and I don't know if the iOS device will 'accept' it and 'use' it?
I thought about changing the architecture and having a middle tier, making the extension a websocket client thus having a single point of contact, this idea was rejected.
Any alternatives I should consider?