For our current implementation we are using a self signed root certificate, which then is used to sign ssl certificates for our secure http connection.
My question relates to the verification logic on the client, which unfortunately, won't have access to the root certificate in trusted root certificate authority.
Is it enough to store the thumbprint of the SSL certificate on the client in a secret vault and then check for compliance in the callback function during the https handshake? Cosidering that it might be possible that someone creates their own SSL certificate and just uses this thumbprint value (which of course is publicly available)? Am I wrong or is it that a standard x.509 certificate can't guarante me that the data hasn't been tampered with?
Wouldn't it be safer to store the public key of the root certificate and use this to check the thumbprint for yourself?
Does this justify the additional overhead for each initial request?