title: Secure communication between two servers
body: <p>I want to securely store private keys of my users on a separate server (lets call it <strong>B</strong>) and it's used to sign, decrypt information. <strong>B</strong> stores keys on a database (postgres).   Server  <strong>A</strong> (public)  sends <em>information</em> to <strong>B</strong>. Ideally <strong>B</strong> needs to get the private key, sign the token with <em>information</em> and send it back to <strong>A</strong>. Instead of sending the private key to <strong>A</strong>, which can be a security issue (if server <strong>A</strong> is compromised). </p>
  
  <p>My options are: </p>
  
  <ol>
  <li>web sockets</li>
  <li>Https request (<a href="https://nodejs.org/api/https.html#https_https_request_options_callback" rel="nofollow">https://nodejs.org/api/https.html#https_https_request_options_callback</a>)</li>
  </ol>
  
  <p>Questions: </p>
  
  <ol>
  <li>Is there any other options to securely communicate with two servers? </li>
  <li>If server <strong>B</strong> was on port "7000" how can I make sure only server <strong>A</strong> can access it?</li>
  <li>How does HSM server help in my case and how does it communicate with other servers (websocket or https request)?</li>
  </ol>
  
  <p>I could just take the easy route and connect database of server <strong>B</strong> on port "7000" and run queries from <strong>A</strong> but as I said it's not as secure. I heard that HSM handles/decrypts information and sends it back, so I though I can do something similar with normal servers. </p>
  
  <p>Thanks any help would be appreciated</p>
  
  <hr>
  
  <p><strong>UPDATE</strong> </p>
  
  <p>@zaph has answered questions 2 and 3. </p>
  
  <p><strong>Question:</strong> Does server <strong>A</strong> need to do a <em>https</em> request and include the private <em>ip</em> address of server <strong>B</strong>, for example <code>https://203.0.113.25</code>? Then server <strong>B</strong> would use an <em>API router</em> to handle the request. However <strong>ip</strong> isn't a DNS, therefore it won't work due to certificates. So how do servers communicate, send/receive data? </p>
  
  <p>Reference: <a href="http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario3.html" rel="nofollow">http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario3.html</a></p>