I am considering an IoT device connected to my local network (default settings, no VPN, no NAT, no DMZ) with or without Internet access. My device will run as a HTTP server offering a RPC mechanism with authentication and authorization. It advertises itself with mDNS and I talk to it using my mobile app or my RaspberryPi.
It seems that the norm in IoT development is to have mutual (two-way) SSL. Does that mean that one-way SSL cannot secure my trafic? Why?
Notes:
- I do understand the technical differences between one and two way SSL, I do not understand why is One-way (almost) never considered in IoT production.
- I understand having mutual SSL for a local device is difficult: you need to share server public key and cert to client and vice-versa. One-way, on the other hand, seems easier (does not require user action).
- Some mass produced devices like Philips Hue would rather have a local http endpoint open and unsecured than a one-way SSL encryption. Why would one make this choice?
- I expect this question not to be opinion-based. Apologies if this is the case.