title: SSL/TLS connection from android to a Custom Socket Server
body: <p>Finished coding a simple Chat Server in erlang that uses gen_tcp (simple sockets) and an Android Client app for TESTING.</p>
  
  <p>Now i need to implement SSL/TLS.</p>
  
  <p>I kept connection (Sending and Receiving Data) part in a single module, a few lines of code that i can upgrade easily.</p>
  
  <p>I have no prior experience of implementing SSL/TLS so i am confused here (like a lot).</p>
  
  <p><strong>Questions - Testing part (localhost):</strong></p>
  
  <p>I can generate self signed certificate by:</p>
  
  <pre><code>openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
  </code></pre>
  
  <p>which results in two files, <strong>key.pem</strong> and <strong>cert.pem</strong>, My understanding is that one is Server certificate and the other is the key file but</p>
  
  <ol>
  <li>Where is Certificate Authority file? Do i need to generate one? Do i need one?</li>
  <li>Are they enough to test my app, to make it ready for a release?</li>
  <li>How do i turn my simple android socket into a secure socket? (kotlin preferred)</li>
  <li>Can i trust my self signed certificate programmatically (and only that one) or do i need to install it on my device (and any other device like a friend's device)</li>
  </ol>
  
  <p><strong>Questions - Production part:</strong></p>
  
  <ol start="5">
  <li><p>SHOULD i use my self signed certificate on my server? Do i need to create a CA? Pros and Cons of using self signed certificate?</p></li>
  <li><p>Can i use free certificates like from letsencrypt forever? Pros and Cons?</p></li>
  </ol>
  
  <p><strong>Finally:</strong></p>
  
  <ol>
  <li><p>Do i need a certificate for Client too? Do i need to provide some sort of key[s] to Android app?</p></li>
  <li><p>What can i do to protect my app from MITM (or protect my app from revealing what is being sent/received to and from server) for example <a href="https://www.charlesproxy.com/documentation/using-charles/ssl-certificates/" rel="nofollow noreferrer">THIS TYPE OF ATTACK</a></p></li>
  </ol>