Id like to create an application which trusts certificates issued from specific CAs.
My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate for authentication, it checks its cert chain and makes sure the thumbprint of its issuing certificate is found in my "trusted thumbprints list".
However, what happens when a CA certificate expires? Will the CA generate a new certificate with a different thumbprint, forcing me to update my list of trusted thumbprints whenever this occurs?
Would trusting CA certs based on public key make a difference, or will these be rotated as well?
How about trusting CA SAN? Can a malicious party create issuing certificates with the same SAN as one of my trusted CAs?