generate certificate at runtime and validate

Question

I have a project that require client application to register and then use the services. I would like to do the following:

1. A client app sends a request with IP, domain name, etc. to my REST service
2. The rest service creates a new certificate based on the parameters and then sends back to the app.
3. The application will then send the thumbprint of the certificate to prove it is genuine.
4. On receiving the certificate, I will use the server certificate which has private key to validate the received input.

I have been searching in the internet and only found that the certificate were created manually. Also, there was no way to generate a certificate on runtime

Please suggest the right practice. I am a .net developer.

Answer 1

You are proposing doing it backwards. It doesn't do you any good to hold a private key on the server and hand out a public certificate to be used to validate the client. Instead, you want the client to make a key pair and submit the certificate to the server to be stored. The server can then use the certificate to generate a challenge for the client to prove they hold the private key for that client.

Don't invent your own security, it will not be secure. The system you propose is broken and insecure as you described it as the public key is not designed for proof of identity, nor is simply sending the thumbprint a way to validate it.