Use application certificate validation during WSS discovery - #4136
Merged
marcschier merged 1 commit intoAug 4, 2026
Conversation
ConfiguredEndpoint refreshed endpoint descriptions with a DiscoveryClient created only from EndpointConfiguration. That path did not receive the application certificate manager, so WSS discovery could not validate a server certificate trusted by the application before opening a session. Add an ApplicationConfiguration-aware endpoint refresh overload and use it from the default and channel-manager session paths. Preserve the existing overloads for compatibility. The application-aware DiscoveryClient now supplies the configured certificate validation for secure discovery transports while TCP and legacy callers retain their existing behavior. Specification: https://reference.opcfoundation.org/Core/Part6/v105/docs/7.5.3 Tests: UpdateFromServerWithNullApplicationConfigurationThrowsArgumentNullException (1 passed, net10.0) Tests: UpdateBeforeConnectUsesApplicationCertificateValidationAsync (1 passed, net10.0)
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR ensures WSS discovery uses the application’s configured certificate validation by refreshing endpoint descriptions via an ApplicationConfiguration-aware discovery client, while retaining existing overloads for backward compatibility.
Changes:
- Added an
ApplicationConfiguration-awareConfiguredEndpoint.UpdateFromServerAsyncoverload and refactored logic into a shared core method. - Updated session/channel-manager flows to use the new overload when
updateBeforeConnectis enabled. - Added/updated tests to cover the null-configuration guard and validate WSS update-before-connect behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Opc.Ua.Sessions.Tests/WssTransportIntegrationTests.cs | Adds an integration test to exercise update-before-connect over WSS with application certificate validation in place. |
| tests/Opc.Ua.Core.Tests/Stack/Client/ConfiguredEndpointTests.cs | Adds a unit test verifying the new overload throws ArgumentNullException when ApplicationConfiguration is null. |
| src/Opc.Ua.Core/Stack/Configuration/ConfiguredEndpoints.cs | Introduces the application-aware overload and routes discovery client creation through ApplicationConfiguration when provided. |
| src/Opc.Ua.Client/Session/Session.ChannelManager.cs | Switches update-before-connect to call the application-aware endpoint refresh overload. |
| src/Opc.Ua.Client/Session/DefaultSessionFactory.cs | Switches discovery-based endpoint refresh to use application configuration for certificate validation. |
| src/Opc.Ua.Client/Session/ChannelManagerSessionFactory.cs | Switches endpoint refresh during preparation to pass ApplicationConfiguration. |
Collaborator
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
marcschier
approved these changes
Jul 31, 2026
Collaborator
|
@jpfr please resolve the copilot issues, then this is ready to go IMO. Thanks for the help! |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #4136 +/- ##
==========================================
- Coverage 80.23% 79.92% -0.31%
==========================================
Files 1515 1515
Lines 209980 210008 +28
Branches 36213 36215 +2
==========================================
- Hits 168479 167852 -627
- Misses 28867 29561 +694
+ Partials 12634 12595 -39
🚀 New features to boost your workflow:
|
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ConfiguredEndpoint refreshed endpoint descriptions with a DiscoveryClient created only from EndpointConfiguration. That path did not receive the application certificate manager, so WSS discovery could not validate a server certificate trusted by the application before opening a session.
Add an ApplicationConfiguration-aware endpoint refresh overload and use it from the default and channel-manager session paths. Preserve the existing overloads for compatibility.
The application-aware DiscoveryClient now supplies the configured certificate validation for secure discovery transports while TCP and legacy callers retain their existing behavior.
Specification:
https://reference.opcfoundation.org/Core/Part6/v105/docs/7.5.3
Tests: UpdateFromServerWithNullApplicationConfigurationThrowsArgumentNullException (1 passed, net10.0)
Tests: UpdateBeforeConnectUsesApplicationCertificateValidationAsync (1 passed, net10.0)
Description
Describe the changes here to communicate to the maintainers why they should accept this pull request. By default - this will become the Commit message after merging and thus define history.
Related Issues
Reference all GitHub issues this PR addresses. If there is no issue yet, open one and link it here.
If this is a relatively large or complex change, a design must have been discussed in the related tracking issue and signed off (which becomes the Architectural Decision Record (ADR)).
Checklist
Put an
xin the boxes that apply. You can complete these step by step after opening the PR.