How to make a "Secure by Design" client-server communication?
The short answer is: No, you can't verify what code is running on the client.  As a result, you should never trust what is running on the client.

You could use all sorts of hashes, but nothing prevents a malicious client from lying to you about its hash and telling you what you want to hear.  Asking the client to hash itself and tell you its hash would be like having airport security ask passengers "Are you a terrorist?" and then believing them when they say "No".

In principle this problem could be solved with trusted hardware on the client, such as a a TPM.  Currently, a TPM is about the only way to check that the client is running unmodified code.  However, in practice using TPMs for this has major issues that typically render it not deployable in practice for the purpose you have in mind.

Therefore, in practice the answer is basically "no, there's no way to check".  See https://security.stackexchange.com/q/72091/971 for an explanation why there is no way to do this without trusted hardware (like a TPM).  As a result, the standard mantra is "you can't trust the client".  See e.g., https://security.stackexchange.com/q/40378/971 for some discussion of alternative architectures don't rely on trusting the client.

For a partial explanation why TPM-based solutions are not really deployable in practice, see https://security.stackexchange.com/q/2459/971.

If you want to explore the TPM approach, see https://security.stackexchange.com/q/5570/971 and https://security.stackexchange.com/q/4008/971.  However, I don't recommend it as a promising avenue.  In the future, Intel will be releasing SGX technology, which might be a better way to achieve this -- but it has not yet been released, so it will be quite some time before you can count on all your clients to run on hardware that supports SGX.