比较Bouncycastle x509和x509certificate2

Question

My use case: I receive emails from various counterparties and they are always signed. I have received their certificate before our communication began, and therefore I have the CORRECT certificate.

I need to verify the certificate they send me originally with the certificate they use when sending a signed email to me.

I have looked through stackoverflow and other forums and they all seem to suggest thumbprint or "GetEncoded" (which is the same as DEREncoded?!)

However I have not been able to find any "official source" that states this is correct.

So what I need is some official source stating that X509Certificate2.GetRawCertData OR Org.BouncyCastle.X509.X509Certificate are unique and therefore can be compared to check for the right certificate.

By offical source I mean books, standards, Microsoft website or the like.

This is the code I use to verify an Org.BouncyCastle.X509.X509Certificate with a System.Security.Cryptography.X509Certificates.X509Certificate2:

Org.BouncyCastle.X509.X509Certificate signerCertificate = ((SecureMimeDigitalCertificate)signature.SignerCertificate).Certificate;
System.Security.Cryptography.X509Certificates.X509Certificate2 localCertificate = new X509Certificate2(@"xxx.crt");
bool areEqual =
    StructuralComparisons.StructuralEqualityComparer.Equals(signerCertificate.GetEncoded(),
                                                            localCertificate.GetRawCertData());

Can you help me find such a source or point me in the right direction?

Answer 1

What is your exact use case for comparing the certificates?

The normal use case when receiving signed email is that you want to verify the signature to ensure the message is authentic. This is not done by comparing certificates received with a certificate you have stored. What you should do is to verify the digital signature, verifying certificates that they link up to a trusted (by you) root. If you have the senders certificate beforehand, you can of course consider this as trusted, and simply use your stored certificate to verify the signature of the message received. In this case you can ignore the certificate in the signed email.

What you do exactly is that you verify that the private key used to sign the message actually belongs to who you think it belongs to, by using your trusted public key (in the certificate) to verify the digital signature.