Just to add: make sure your applications handle SSL certificates properly, and only trust either verified signed certificates or only the known certificate from

Just to add: make sure your applications handle SSL certificates properly, and only trust either verified signed certificates or only the known certificate from the API server. Otherwise MITM could still expose everything.