Looking at a potential solution where the thumbprint of a client cert is used to identify individual users and provide access control.
Supposing someone was able to view the thumbprint of a cert installed on a machine, would they be able to create/fake a cert with an identical thumbprint to impersonate another user?
I expect it would be a safe solution where the cert is issued by a trusted authority. That might or might not be an option, but at the moment looking at self-signed certs. (The process for creating, installing and recording the thumbprints of certs is considered secure. The bit I am not sure about is whether someone could just create a self signed cert with the same CN and thumbprint, were they able to view it.)
If the thumbprint approach is not good, is there an alternative way of identifying the certs that would be secure?