X509 mutual authentication: is there a security flaw?

Question

On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a user to confirm security exception every time (e.g. like browsers)?

To clarify the question:
What I have: [server-cert][CA cert] (server chain); [client-cert][server-cert'] (client chain).
What the application does: if server-cert == server-cert', then the client trusts the server. I'm asking if this is correct behavior or it can cause flaws.

Answer 1

If the check you outline above is the only check made for authentication, then there are some major problems.

1. The check only tests the server's cert given to the client. The server never checks the client's cert. So no mutual authentication.
2. The client never has to prove knowledge of their private key
3. The server never has to prove knowledge of their private key

Furthermore, as pointed out by ewanm89, there are issues if the initial cert signing is not done over a secure channel.

Answer 2

I don't understand the question. Can you provide more details? What are you trying to achieve?

In my experience with SSL, it would be extremely unusual to have a client cert that is signed by the server. Usually certs are signed by a CA. A CA should be a separate party from the server or the client; the CA is expected to sign certs for servers and for clients.

I'm not sure what security exception you are referring to.