I was wondering if comparing the
X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not.
Of course this would only work for specific certificates the app knows about and not for all connection via https.
In my app I have only a view connection I am opening via https and I could easily hold the thumbprint of those view certificates inside the app, comparing them when I open a connection to identify if the certificate is valid or not.
As far as I understand it, there are no attacking vectors with this approach.
Another question I have is on how the
X509Certificate2.Thumbprint is generated and if this thumbprint changes if the certificate changes from self-signed to be signed by any CA.