I have a multiplayer game with a custom client app and an application server (no browser or website). I need

  1. the data that passes between them to be encrypted both for the login data obviously and for the game actions.
  2. that the server answer only to requests from my clients and that the clients get information only from the server.

From what I read, I need 2 certificates for that. Can I use self-signed certificates for the client and server? How do other games usually handle this?

  • \$\begingroup\$ If you think that adding encryption will prevent people from creating a clone which will communicate with your server, then I have to disappoint you. Any form of encryption requires that your client contains a cryptographic key. A determined attacker can find and copy it. \$\endgroup\$ – Philipp Nov 11 '18 at 22:15
  • \$\begingroup\$ @Philipp No I don't think it will prevent hacking but i think it could deter. Software puts all sorts of defenses but they still get hacked, doesn't mean they shouldn't do it. Also I think it will help protect the clients from false information from fake servers, no? And I still need to encrypt login and later on purchase info anyway... \$\endgroup\$ – Mark Nov 11 '18 at 23:34
  • 1
    \$\begingroup\$ Self signing an SSL certificate will not do, no, as it will not do anything to stop man in the middle attacks, i.e. defeating your second point. Getting a SSL/TLS certificate is free of charge these days anyway, so no excuses. But yeah, whatever application level protocol you're using, doing it over SSL/TLS will almost certainly be the way to go (so HTTPS or DTLS), and fulfills both of your requirements (Not to say this is the only way, there are many) \$\endgroup\$ – ZombieTfk Nov 13 '18 at 1:04
  • \$\begingroup\$ @SamJudge Thank you! i didn't know that SSL cert is vulnerable this way and that you can get ones free. That's very helpful. I'm interested in the other ways to fulfil the requirements (I asked how other games do it). Can you write an answer? \$\endgroup\$ – Mark Nov 13 '18 at 10:49
  • \$\begingroup\$ @SamJudge Looking at let'sEncrypt that you linked, I don't see how to create the client certificate, only the server one. \$\endgroup\$ – Mark Nov 13 '18 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.