Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general process is that the client verifies against the CA's public key, and not my own, so I do not even need to transmit the public key, but what is the best practice to implement this in a C# client application?
My current chosen approach is that on the server application, I am storing the certificate (which contains my private key) in my local store, which I use to sign data. Then, on the client application, I am loading the Root store of the Current User and I pass the certificate name of the CA which signed my certificate, and if this CA is found in the store, I retrieve its public key and I verify against that. If my public key has been signed by the CA, then verification should succeed, otherwise it will fail. Is this the correct way of implementing it? If not, please provide better solutions.
The following are my questions regarding my chosen approach:
Can the Certificate Name of the CA change? If so, I would have to change it in code. If this can change, what else should I use to search for the certificate? Maybe the SerialNumber?.
Can someone create the same Certificate Name. I am assuming that you can. For instance, a hacker might create a certificate name which is the same as an established CA, but it is obviously up the user to add it to the trusted store on his machine. If he does not, then the hacker does not have any power whatsoever. Also, I do not think that two certificates can have the same Serial Number.
If my private key is hijacked and I revoke the certificate, verification should start failing on the client's applications. It will start verifying successfully once I start signing the messages with the newly issued certificate by the CA. Is this correct?
Finally, I do not currently possess a signed certificate so I cannot test this out. That is why I am asking these questions, so that if this approach is correct, I can proceed to buy a certificate since I know the way forward. Also, hopefully, this question might help other people with the same problem.
Thanks in advance.