This is a follow up to this question I asked before.
While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to cover.
The scenario I'm thinking of is if a malicious user gets hold of the self signed certificate (i.e. PFX file installed on machine running the Windows Service). I believe in this scenario this user can load the certificate in an application that's not the intended Windows Service, and the client will trust it because it will have the same thumbprint.
Is there a way to bind the self signed certificate to a specific application (the Windows Service in my scenario, which itself is a signed exe), so that it cannot be used/loaded by other applications? This means if the certificate is compromised, it is useless to the attacker as they can't use it in their "fake" service.
I thought of password protecting the PFX file, however that means I need to securely distribute the password, which brings me back to square one.