From 0380603d498ca0a1bbb950dfd3040b2fcdd83f88 Mon Sep 17 00:00:00 2001
From: Roman Ettlinger <romanett98@gmail.com>
Date: Sat, 2 May 2026 20:07:09 +0200
Subject: [PATCH] filter CertifiicateStatusCodes before returing to client

---
 Libraries/Opc.Ua.Server/Server/StandardServer.cs | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/Libraries/Opc.Ua.Server/Server/StandardServer.cs b/Libraries/Opc.Ua.Server/Server/StandardServer.cs
index ba85fcc8f8..5dbd21f0ae 100644
--- a/Libraries/Opc.Ua.Server/Server/StandardServer.cs
+++ b/Libraries/Opc.Ua.Server/Server/StandardServer.cs
@@ -2620,7 +2620,20 @@ namespace Opc.Ua.Server
             byte[] clientCertificate,
             ServiceResult result)
         {
-            throw new ServiceResultException(result);
+            // see https://reference.opcfoundation.org/Core/Part4/v105/docs/6.1.3
+            StatusCode resultCode = result.StatusCode;
+            if (resultCode == StatusCodes.BadCertificateInvalid ||
+                resultCode == StatusCodes.BadCertificateRevoked ||
+                resultCode == StatusCodes.BadCertificateUntrusted ||
+                resultCode == StatusCodes.BadCertificateIssuerRevoked ||
+                resultCode == StatusCodes.BadCertificateRevocationUnknown ||
+                resultCode == StatusCodes.BadCertificateChainIncomplete ||
+                resultCode == StatusCodes.BadCertificateIssuerRevocationUnknown)
+            {
+                resultCode = StatusCodes.BadSecurityChecksFailed;
+            }
+
+            throw new ServiceResultException(new ServiceResult(resultCode, result));
         }
 
         /// <summary>