title: client certificate authentication in https using X509Certificate2
body: <p>I am trying to understand how does client authentication work in https scenario and how to use it to provide a basic authentication/authorization capability.</p>
  
  <p>Let's say I want to have a mapping between a certificate and a user (eg. IPrincipal). My server issues certs and distributes them to the clients. When client connects I ask for certificate and if a valid certificate has been provided I authenticate the user based on the mapping defined earlier. </p>
  
  <p>What should I use to create the mapping? Is cert thumbprint a good candidate? Is it enough to determine client identity?</p>
  
  <p>Or maybe I don't need the mapping at all and can simply accept all certs issued by my server ?</p>
  
  <p>Edit: Let me rephrase it - assuming that I can issue client certificates, how do I verify clients identity during https session?</p>