A recent project with banking might bring some insight for this. Since banks use it I am sure you can.
This is about sending data from client domain to bank domain using GET/POST data with a HASH. The key here is that the server of the client uses a Private key within a long string of data to verify the origin and the integrity of the data being sent. Prevents tampering and man in the middle attacks. But it does not obscure data unless you use HTTPS
In your case you can use the serial number, mac address, SD card serial number,and anything else that is unique to the hardware configuration.
Private key: !PRIVATE!
String to hash: rpiserial!PRIVATE!macaddres!PRIVATE!sdserial!PRIVATE!timestamp!PRIVATE! etc...
HASH : SHA256 recommended
The time stamp shgould be a unique number generated on the Pi that is never repeated but you can generate the number on your server based on the information you know about the Pi. Like Google authenticator or some algorithm that generates unique number for that Pi only.
Now you can generate a private key for each RPI, keep it on the Pi and on your Secure server. Keep all the data on the secure server. Everytime a request comes in you compare the HASH from the Pi on the Server. If it matches it means the origin is unique.
The only problem is that if somebody steals the SD card they have access to the Private key and your unqiue number generator. So they might compromise that single Pi without you knowing, but the rest will be Fine.
That verifies the origin, based on the hash of all the hardware serials you are using.
Then if you embed encrypted data you know its from that Pi, and its not been tampered with and you can unencrypted and trust it.
As long as both devices are in a secure place and cannot be accessed by anybody this is pretty solid for now.
You should read up about DRM used in games or a technique called perfect forward encryption.