title: SmartCard security, how do you authenticate the certificate as not fake?
body: <p>I'm trying to develop an ASP.net site that reads the clientCertificate to ensure a smart card was used to access the website (trying to do away with username/password login).</p>
  
  <p>The process I have in my mind is:</p>
  
  <ol>
  <li>User registers an account and C# records user's clientCertificate (public). </li>
  <li>The user can then log in the next time with that same clientCertificate, and they are now an authenticated user if hash valid.</li>
  <li><strong>I will use the code below</strong> to ensure authenticity of certificate. The browser should deal with private keys and ensure the certificate was NOT faked.</li>
  <li>Based on Subject+certificate combination, C# assigns them their role-access.</li>
  </ol>
  
  <p>The following code can be used for authenticity of certificate right?</p>
  
  <pre><code>X509Certificate x509Cert = new X509Certificate(Request.ClientCertificate.Certificate);
  SHA1 sha = new SHA1CryptoServiceProvider();
  byte[] hashvalue = sha.ComputeHash(Request.ClientCertificate.Certificate);
  byte[] x509Hash = x509Cert.GetCertHash();
  // compare x509Hash WITH hashvalue to ensure they are a match. 
  // If not, possibly faked certificate, not a real smartcard???
  </code></pre>
  
  <p>Is this how SmartCard authentication process should work???</p>