I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific certificates the app knows about and not for all connection via https. In my app I have only a view connection I am opening via https and I could easily hold the thumbprint of those view certificates inside the app, comparing them when I open a connection to identify if the certificate is valid or not. As far as I understand it, there are no attacking vectors with this approach.

Another question I have is on how the X509Certificate2.Thumbprint is generated and if this thumbprint changes if the certificate changes from self-signed to be signed by any CA.

  • See morgansimonsen.com/2013/04/16/… and msdn.microsoft.com/en-us/library/… for a start. – a CVn Jul 28 '16 at 13:58
  • thanks the first site helped me alot, especially in answering my last question. The second site, obviously, I already knew. But what about possible attack vectors? Are there any? – zlZimon Jul 28 '16 at 14:34
  • so after reading this it looks like that only comparing the thumbprints is a secure way to ensure that there website I am talking to is the one I think it is? – zlZimon Aug 2 '16 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.