I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send random requests to it using wget or anything similar.
My idea was to configure a SSL/TLS on my server, thus making the API only available over HTTPS and enforce a client certificate check on the server. Every copy of the app will have the (same) client certificate bundled with it.
Note that I'm not doing this for the purpose of a user authentication, just for limiting access from sources other than my app.
Is is a valid solution? It appeals to me a lot because of how simple it is. Are there any obvious flaws with it? How likely is that the certificate will be unbundled from the app and used for malicious purposes?