title: How to get Thumbprint or Public Key of Issuer Certificate?
body: <p>We have created a self signed CA certificate which we use to sign other certificates for SSL purposes. These certificates will be installed in other servers which we do not have access to and will be strictly to communicate with other clients like mobile applications.</p>
  
  <p>When these clients (written in .NET) make a request to the servers using HTTPS we get the "Invalid certificate received from server" error because the CA cert is not a trusted CA on that client.</p>
  
  <p>We want to bypass this security using the <code>ServicePointManager.ServerCertificateValidationCallback</code>, but only if the certificate being used was signed by our CA certificate. </p>
  
  <p>I can check the <code>certificate.Issuer</code>, but that can easily be spoofed by anyone. How can I get the Thumbprint or Public Key of the Issuer certificate of the invalid certificate? If I can get access to that I can easily compare it to the one I know is valid and ignore the certificate error and continue on with the request.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I think I am getting closer. It looks like what we're looking to do is not doable so went a slightly different direction. </p>
  
  <p>Using the <code>X509Chain</code> we can verify whether the certificate is a child of the CA using the code below:</p>
  
  <pre><code>var caCert = new X509Certificate2(@"[path]\MyCA.cer");
  
  var newChain = new X509Chain();
  newChain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
  newChain.ChainPolicy.ExtraStore.Add(caCert);
  
  var res = newChain.Build(certInQuestion);
  </code></pre>
  
  <p><code>Build()</code> still returns false (as expected because the CA is not trusted on the client), but now <code>newChain.ChainStatus[0].Status</code> is returning <code>UntrustedRoot</code>. Based on my testing this means the chain validated because if I supply a different CA Certificate it fails with <code>InvalidChain</code>.</p>
  
  <p>In conclusion, that tells me that if the Status is <code>UntrustedRoot</code>, the certificate <em>was</em> created with our CA certificate and thus it's valid, anything else it's a fake one!</p>
  
  <p>Are my assumptions correct?</p>