I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is white listed. Also it verifies that the cert is valid (cert chain validation).
But if an attacker gets a certificate with the same subject name that is issued by some certificate authority, they can attack our service, right? This seems less secure to me. Server SSL certificates are secure because users are reaching to a domain explicitly and the SSL cert the server uses contains the domain name validated by a cert authority. Unless the server certificate and some how the domain the user is trying to reach is compromised, the server is secure and client can trust the server.
But trusting a client seems less secure to me. Is my understanding right or am I missing something?