I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's PEMParser) which is then imported to the client keystore.
The questions are:
Should i verify/validate anything before importing the given client certificate? Either as a String (encoding? pre/postfix?) or as a certificate? I guess i can check that the certificate really originated from my csr (from my public key). I'm not sure i can validate that the signing authority is trusted by me (I think it's not necessarily the case if a different CA is used for signing the client's certificates and it's not necessarily trusted by the clients).
What risk am i introducing by not verifying/validating anything on it? I can't think of any attack.