Verifying A Server's Identity

Question

What is the best means to verify that a server is who it says it is.

I'm guessing using signed SSL certs is the best route, but was wondering if there was any programmatic means to do this..

EDIT: This is for a an app where servers deal with other servers (authenticating each other) in order to exchange user info. (sorry if I forgot to mention that)

Answer 1

SSL certificates signed by an authorized CA (certificate authority) is the only way to be sure. Anything else can be faked, and especially any "programmatic means" would be particularly unreliable. Short and simple: an authorized SSL cert is the only thing a browser will recognize as reliable, regardless.

Answer 2

You don't need certificates to prove your identity (or a server's for that case) to someone. You can use pre-shared keys for that purpose, and avoid any public key infrastructure. The TLS (or SSL) protocol supports that . Find a TLS library that allows you to use TLS-PSK and use it.

Answer 3

I'd recommend HMAC or RSA. HMAC is pretty secure and much easier to implement. HMAC could get unwieldy if you have 5 servers that all need to communicate with each other directly.

What are you trying to secure? It sounds like a web application, and if it is one, then you should go with SSL certs.