Search code examples
httpsself-signedman-in-the-middle

Is self-signed HTTPS + WHITELISTED IP safe for RPC

There is a HTTPS server with self-signed certificate on IP A and a https client on IP B. The server only allow access from IP B in IPTABLES. The client access server with the correct domain name and IP(defined in local host file).

Is this a safe pattern? I want to use this pattern for remote procedure call between two hosts with public IP. Is there any security problems. Can it prevent man-in-middle attack?

Solution

  • MitM attacks are still possible as long as the https client doesn't verify the certificate somehow (e.g. by comparing the fingerprint).

    Man-in-the-Middle means that an attacker is between A and B: For A it seems as if A is talking directly to B and for B vice versa, but in reality both are talking with the attacker.

    Verifying the SSL certificate (e.g., by trusting a CA or verifying a fingerprint) B (the client) can verify that it is really talking to A an not to an attacker.