title: SSL authentication by comparing certificate fingerprint?
body: <p>Question for all the SSL experts out there:</p>
  
  <p>We have an embedded device with a little web server on it, and we can install our own SSL self-signed certificates on it. The client is written in .NET (but that doesn't matter so much). </p>
  
  <p>How can I authenticate the device in .NET? Is it enough to <strong>compare the fingerprint</strong> of the certificate <strong>against a known entry</strong> in the database? </p>
  
  <p>My understanding is that the fingerprint is a hash of the whole certificate, including the public key. A device faking to be my device could of course send the same public certificate, but it couldn't know the private key, right?</p>
  
  <p>Or do I have to build up my own chain of trust, create my own CA root certificate, sign the web server certificate and install that on the client?</p>