How to protect software from http response forgery?

Question

C++ / C#

Good afternoon, I'm making a small licensing system.
A person buys a key, enters it in the program -> the program sends it to the server and checks whether the hardware
in the database matches the local hardware, if so, then the license is correct.
I can protect the binary itself from modification, but there is no answer from the server against forgery. Please tell me who has experience

Answer 1

Your program has been hacked using a mitm certificate spoofing attack. This means that the program does not validate the server certificate (figuratively speaking, ServicePointManager.ServerCertificateValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;), which allows an attacker to generate a self-signed certificate for your domain, redirect traffic to his local server and the program will trust this server as your own. Either validates using root certificates from the operating system trust store. In this case, the attacker will simply add his generated certificate to the OS trust store and your program will trust the fake certificates of the attackers.
The solution to this problem is to use the certificate pinning or public key pinning technique.. That is, you need to sew into the program the root certificate of the CA from which you purchase certificates (lets encrypt?) and validate responses only using it. No OS trust store and never ignore validation errors.