I am creating a client-server application and I'd like to send data from server to client securely.

Using public/private key algorithms makes sense and in PHP we can use openssl_sign and openssl_verify functions to check that the data came by someone who has the private key.

Now imagine that one of the actions sent by server to client is destructive in nature. If somebody uses an HTTP sniffer to catch this command (which will be signed properly) how can I further protect the communication to ensure that only commands coming from our server get processed by the client?

I was thinking about using current UTC time as part of the encrypted data but client time might be off.

Is there a simple solution to the problem?