diff --git a/.gitignore b/.gitignore
index 0a9ea7b6a2..11f93fe016 100644
--- a/.gitignore
+++ b/.gitignore
@@ -68,6 +68,7 @@ artifacts/
 *.svclog
 *.scc
 
+
 # Chutzpah Test files
 _Chutzpah*
 
@@ -236,4 +237,6 @@ _Pvt_Extensions
 # OPC UA Sample app certificate stores
 OPC\ Foundation/
 *.der
+*.pfx
 /UA-NetStandard.VC.db
+*.log.txt
diff --git a/CreateAllCerts.cmd b/CreateAllCerts.cmd
deleted file mode 100644
index ff8c0abff9..0000000000
--- a/CreateAllCerts.cmd
+++ /dev/null
@@ -1,30 +0,0 @@
-@echo off
-
-REM Create all certs for OPC UA apps
-cd /D %~dp0
-
-echo Clear all certificate stores and renew all certificates 
-echo Press key to continue or Ctrl-C to exit
-pause >NUL
-
-rem ensure Opc.Ua.CertificateGenerator.exe exists
-where /q Opc.Ua.CertificateGenerator.exe
-if errorlevel 1 goto :NeedCertGenerator
-
-echo Creating all applications certificates
-
-For /R .\ %%G IN (CreateCer?.cmd) DO ( 
-   pushd "%%~pG"
-   cmd /c CreateCert.cmd
-   popd
-)
-cd /D %~dp0
-
-echo All certificates generated
-
-exit /b 0
-
-:NeedCertGenerator
-@Echo Opc.Ua.CertificateGenerator.exe not found 
-@Echo Please download from https://github.com/OPCFoundation/UA-.NETStandardLibrary
-exit /b 1
\ No newline at end of file
diff --git a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs
index 7ee5250c57..00ea655a54 100644
--- a/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs
+++ b/SampleApplications/SDK/Opc.Ua.Configuration/ApplicationInstance.cs
@@ -696,6 +696,12 @@ namespace Opc.Ua.Configuration
                 }
             }
 
+            // create a new certificate.
+            if (certificate == null)
+            {
+                certificate = await CreateApplicationInstanceCertificate(configuration, InstallConfig.MinimumKeySize, InstallConfig.LifeTimeInMonths);
+            }
+
             // ensure the certificate is trusted.
             await AddToTrustedStore(configuration, certificate);
 
@@ -981,25 +987,31 @@ namespace Opc.Ua.Configuration
                     }
                 }
             }
-                       
+
             if ((certificate == null) || !certificateValid)
             {
-                string message = Utils.Format(
-                    "There is no cert with subject {0} in the configuration." +
-                    "\r\n Please generate a cert for your application," +
-                    "\r\n for example using the provided scripts in the sample" +
-                    "\r\n application's project directory, or OpenSSL, or the" +
-                    "\r\n OPC Foundation's certificate generator." +
-                    "\r\n Then copy the new cert to this location:" +
-                    "\r\n{1}",
-                    id.SubjectName,
-                    id.StorePath);
-                throw ServiceResultException.Create(StatusCodes.BadConfigurationError, message);
-            }
+                certificate = await CreateApplicationInstanceCertificate(configuration, minimumKeySize);
 
-            // ensure it is trusted.
-            await AddToTrustedStore(configuration, certificate);
-            
+                if (certificate == null)
+                {
+                    string message = Utils.Format(
+                        "There is no cert with subject {0} in the configuration." +
+                        "\r\n Please generate a cert for your application," +
+                        "\r\n for example using the provided scripts in the sample" +
+                        "\r\n application's project directory, or OpenSSL, or the" +
+                        "\r\n OPC Foundation's certificate generator." +
+                        "\r\n Then copy the new cert to this location:" +
+                        "\r\n{1}",
+                        id.SubjectName,
+                        id.StorePath);
+                    throw ServiceResultException.Create(StatusCodes.BadConfigurationError, message);
+                }
+            }
+            else
+            {
+                // ensure it is trusted.
+                await AddToTrustedStore(configuration, certificate);
+            }
 
             // add to discovery server.
             if (configuration.ApplicationType == ApplicationType.Server || configuration.ApplicationType == ApplicationType.ClientAndServer)
@@ -1202,7 +1214,111 @@ namespace Opc.Ua.Configuration
 
             return valid;
         }
-        
+
+        /// <summary>
+        /// Creates the application instance certificate.
+        /// </summary>
+        /// <param name="configuration">The configuration.</param>
+        /// <param name="keySize">Size of the key.</param>
+        /// <param name="lifetimeInMonths">The lifetime in months.</param>
+        /// <returns>The new certificate</returns>
+        private static async Task<X509Certificate2> CreateApplicationInstanceCertificate(
+            ApplicationConfiguration configuration,
+            ushort minimumKeySize = CertificateFactory.defaultKeySize,
+            ushort lifeTimeInMonths = CertificateFactory.defaultLifeTime
+            )
+        {
+            Utils.Trace(Utils.TraceMasks.Information, "Creating application instance certificate.");
+
+            // delete any existing certificate.
+            DeleteApplicationInstanceCertificate(configuration);
+
+            CertificateIdentifier id = configuration.SecurityConfiguration.ApplicationCertificate;
+
+            // get the domains from the configuration file.
+            IList<string> serverDomainNames = configuration.GetServerDomainNames();
+
+            if (serverDomainNames.Count == 0)
+            {
+                serverDomainNames.Add(Utils.GetHostName());
+            }
+
+            // ensure the certificate store directory exists.
+            if (id.StoreType == CertificateStoreType.Directory)
+            {
+                Utils.GetAbsoluteDirectoryPath(id.StorePath, true, true, true);
+            }
+
+            X509Certificate2 certificate = CertificateFactory.CreateCertificate(
+                id.StoreType,
+                id.StorePath,
+                configuration.ApplicationUri,
+                configuration.ApplicationName,
+                id.SubjectName,
+                serverDomainNames,
+                minimumKeySize,
+                lifeTimeInMonths
+                );
+
+            id.Certificate = certificate;
+
+            await AddToTrustedStore(configuration, certificate);
+
+            await configuration.CertificateValidator.Update(configuration.SecurityConfiguration);
+
+            Utils.Trace(Utils.TraceMasks.Information, "Certificate created. Thumbprint={0}", certificate.Thumbprint);
+
+            // reload the certificate from disk.
+            await configuration.SecurityConfiguration.ApplicationCertificate.LoadPrivateKey(null);
+
+            return certificate;
+        }
+
+        /// <summary>
+        /// Deletes an existing application instance certificate.
+        /// </summary>
+        /// <param name="configuration">The configuration instance that stores the configurable information for a UA application.</param>
+        private static async void DeleteApplicationInstanceCertificate(ApplicationConfiguration configuration)
+        {
+            Utils.Trace(Utils.TraceMasks.Information, "Deleting application instance certificate.");
+
+            // create a default certificate id none specified.
+            CertificateIdentifier id = configuration.SecurityConfiguration.ApplicationCertificate;
+
+            if (id == null)
+            {
+                return;
+            }
+
+            // delete private key.
+            X509Certificate2 certificate = await id.Find();
+
+            // delete trusted peer certificate.
+            if (configuration.SecurityConfiguration != null && configuration.SecurityConfiguration.TrustedPeerCertificates != null)
+            {
+                string thumbprint = id.Thumbprint;
+
+                if (certificate != null)
+                {
+                    thumbprint = certificate.Thumbprint;
+                }
+
+                using (ICertificateStore store = configuration.SecurityConfiguration.TrustedPeerCertificates.OpenStore())
+                {
+                    await store.Delete(thumbprint);
+                }
+            }
+
+            // delete private key.
+            if (certificate != null)
+            {
+                using (ICertificateStore store = id.OpenStore())
+                {
+                    await store.Delete(certificate.Thumbprint);
+                }
+            }
+        }
+
         /// <summary>
         /// Adds the application certificate to the discovery server trust list.
         /// </summary>
diff --git a/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs b/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs
index 53105107a9..3ef283b808 100644
--- a/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs
+++ b/SampleApplications/SDK/Opc.Ua.Configuration/Schema/InstalledApplication.cs
@@ -77,8 +77,8 @@ namespace Opc.Ua.Configuration
             ServicePassword = null;
             ServiceDescription = null;
             LocallyRegisterOIDs = false;
-            MinimumKeySize = 1024;
-            LifeTimeInMonths = 300;
+            MinimumKeySize = CertificateFactory.defaultKeySize;
+            LifeTimeInMonths = CertificateFactory.defaultLifeTime;
     	}
     	#endregion
 
diff --git a/SampleApplications/Samples/Client.Net4/CreateCert.cmd b/SampleApplications/Samples/Client.Net4/CreateCert.cmd
deleted file mode 100644
index 10300fbf74..0000000000
--- a/SampleApplications/Samples/Client.Net4/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Client" -dn %COMPUTERNAME% -sn "CN=UA Sample Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleClient"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj
index 59b0b9cd26..ee0c2a1bdf 100644
--- a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj	
+++ b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj	
@@ -207,9 +207,6 @@
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </Content>
   </ItemGroup>
-  <ItemGroup>
-    <None Include="CreateCert.cmd" />
-  </ItemGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
diff --git a/SampleApplications/Samples/Client/App.xaml.cs b/SampleApplications/Samples/Client/App.xaml.cs
index 0c5af8f25c..aa4e212b90 100644
--- a/SampleApplications/Samples/Client/App.xaml.cs
+++ b/SampleApplications/Samples/Client/App.xaml.cs
@@ -5,6 +5,7 @@ using System;
 using System.Threading.Tasks;
 using Windows.ApplicationModel;
 using Windows.ApplicationModel.Activation;
+using Windows.Storage;
 using Windows.UI.Xaml;
 using Windows.UI.Xaml.Navigation;
 
@@ -38,6 +39,10 @@ namespace Opc.Ua.SampleClient
             application.ApplicationType = ApplicationType.ClientAndServer;
             application.ConfigSectionName = "Opc.Ua.SampleClient";
 
+            // helper to let Opc.Ua Utils find the localFolder in the environment
+            StorageFolder localFolder = ApplicationData.Current.LocalFolder;
+            Utils.DefaultLocalFolder = localFolder.Path;
+
             // set empty page for MessageDlg
             Window.Current.Content = new ClientPage();
 
diff --git a/SampleApplications/Samples/Client/CreateCert.cmd b/SampleApplications/Samples/Client/CreateCert.cmd
deleted file mode 100644
index 10300fbf74..0000000000
--- a/SampleApplications/Samples/Client/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Client" -dn %COMPUTERNAME% -sn "CN=UA Sample Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleClient"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/Client/Opc.Ua.SampleClient.Config.xml b/SampleApplications/Samples/Client/Opc.Ua.SampleClient.Config.xml
index 6a91a1d1e2..21cb626537 100644
--- a/SampleApplications/Samples/Client/Opc.Ua.SampleClient.Config.xml
+++ b/SampleApplications/Samples/Client/Opc.Ua.SampleClient.Config.xml
@@ -31,7 +31,7 @@
            The name of the store is appended.
            Note that the names used in code are difference from what appears in the control panel.
            e.g. My == "Personal", Root == "Trusted Root Certification Authorities" -->
-      <StorePath>OPC Foundation\CertificateStores\MachineDefault</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\MachineDefault</StorePath>
 
 
       <!-- The subject for the certificate 
@@ -39,7 +39,7 @@
            A complete distinguished would be something like: 'CN=UA Sample Client, DC=MACHINENAME'
            The first certificate found is used if multiple certificates with the same CommonName exist. 
            The Thumbprint should be specified if the CommonName does not uniquely identify a certificate. -->
-      <SubjectName>UA Sample Client</SubjectName>
+      <SubjectName>Opc.Ua.SampleClient</SubjectName>
 
       <!-- The SHA1 thumbprint for the certificate.
            The thumbprint uniquely identifies a certificate.
@@ -60,7 +60,7 @@
          specify the certificate for each trusted certification authority. -->
     <TrustedIssuerCertificates>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\UA Certificate Authorities</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities</StorePath>
     </TrustedIssuerCertificates>
     
     <!-- The list of trusted certificates. 
@@ -79,7 +79,7 @@
          -->
     <TrustedPeerCertificates>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\UA Applications</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\UA Applications</StorePath>
     </TrustedPeerCertificates>
     
     <!-- Applications exchange Nonces during the CreateSession. This value specifies the length. Must be >= 32 -->
@@ -88,7 +88,7 @@
     <!-- The directory used to store invalid certficates for later review by the administrator. -->
     <RejectedCertificateStore>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\RejectedCertificates</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates</StorePath>
     </RejectedCertificateStore>
   
 </SecurityConfiguration>
@@ -144,7 +144,6 @@
          http://localhost:61211/UA/SampleClient/Basic256 -->
     <BaseAddresses>
       <ua:String>opc.tcp://localhost:61210/UA/SampleClient</ua:String>
-      <ua:String>https://localhost:61212/UA/SampleClient/</ua:String>
     </BaseAddresses>
 
     <!-- 
@@ -176,7 +175,12 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
-        <SecurityLevel>3</SecurityLevel>
+        <SecurityLevel>4</SecurityLevel>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
+        <SecurityLevel>2</SecurityLevel>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>None_1</SecurityMode>
@@ -191,13 +195,18 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
-        <SecurityLevel>4</SecurityLevel>
+        <SecurityLevel>5</SecurityLevel>
       </ServerSecurityPolicy>      
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
         <SecurityLevel>3</SecurityLevel>
       </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityLevel>6</SecurityLevel>
+      </ServerSecurityPolicy>
     </SecurityPolicies>
 
     <MinRequestThreadCount>5</MinRequestThreadCount>
@@ -218,6 +227,8 @@
         <!-- passwords must be encrypted - this specifies what algorithm to use -->
         <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
+
+      <!-- Allows user certificates -->
       <ua:UserTokenPolicy>
         <ua:TokenType>Certificate_2</ua:TokenType>
         <!-- certificate possession must be proven with a digital signature - this specifies what algorithm to use -->
@@ -227,12 +238,12 @@
       Issued tokens are any type of WS-Security compliant token
       This is a URN assigned by OASIS to SAML Security Tokens
       tokens must be encrypted - this specifies what algorithm to use
-      -->
       <ua:UserTokenPolicy>
         <ua:TokenType>IssuedToken_3</ua:TokenType>
         <ua:IssuedTokenType>urn:oasis:names:tc:SAML:1.0:assertion:Assertion</ua:IssuedTokenType>
         <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
+      -->
     </UserTokenPolicies>
     
     <!-- Whether the server updates its diagnostic information -->
@@ -404,14 +415,14 @@
   -->
   
   <TraceConfiguration>
-    <OutputFilePath>Logs\Opc.Ua.SampleClient.log.txt</OutputFilePath>
+    <OutputFilePath>%LocalFolder%\Logs\Opc.Ua.SampleClient.log.txt</OutputFilePath>
     <DeleteOnLoad>true</DeleteOnLoad>
     <!-- Show Only Errors -->
     <!-- <TraceMasks>1</TraceMasks> -->
     <!-- Show Only Security and Errors -->
-    <!-- <TraceMasks>513</TraceMasks> -->
+    <TraceMasks>513</TraceMasks>
     <!-- Show Only Security, Errors and Trace -->
-    <TraceMasks>515</TraceMasks>
+    <!-- <TraceMasks>515</TraceMasks> -->
     <!-- Show Only Security, COM Calls, Errors and Trace -->
     <!-- <TraceMasks>771</TraceMasks> -->
     <!-- Show Only Security, Service Calls, Errors and Trace -->
diff --git a/SampleApplications/Samples/Client/project.json b/SampleApplications/Samples/Client/project.json
index f485155aa6..25fecea223 100644
--- a/SampleApplications/Samples/Client/project.json
+++ b/SampleApplications/Samples/Client/project.json
@@ -1,5 +1,6 @@
 {
   "dependencies": {
+    "Portable.BouncyCastle": "1.8.1.2",
     "Microsoft.NETCore.UniversalWindowsPlatform": "5.2.2",
     "System.Xml.XmlDocument": "4.0.1"
   },
diff --git a/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd b/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd
deleted file mode 100644
index a2571080bb..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleClient/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate for NetCoreConsoleClient
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Client" -dn %COMPUTERNAME% -sn "CN=UA Sample Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleClient"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs
index fd511d8354..bb9c83dbb3 100644
--- a/SampleApplications/Samples/NetCoreConsoleClient/Program.cs
+++ b/SampleApplications/Samples/NetCoreConsoleClient/Program.cs
@@ -15,6 +15,7 @@ using System.Collections.Generic;
 using System.Threading.Tasks;
 using Opc.Ua;
 using Opc.Ua.Client;
+using System.Security.Cryptography.X509Certificates;
 
 namespace NetCoreConsoleClient
 {
@@ -49,31 +50,31 @@ namespace NetCoreConsoleClient
             Console.WriteLine("1 - Create an Application Configuration.");
             var config = new ApplicationConfiguration()
             {
-                ApplicationName = "UA Sample Client",
+                ApplicationName = "UA Core Sample Client",
                 ApplicationType = ApplicationType.Client,
-                ApplicationUri = "urn:"+Utils.GetHostName()+":OPCFoundation:SampleClient",
+                ApplicationUri = "urn:"+Utils.GetHostName()+":OPCFoundation:CoreSampleClient",
                 SecurityConfiguration = new SecurityConfiguration
                 {
                     ApplicationCertificate = new CertificateIdentifier
                     {
                         StoreType = "Directory",
-                        StorePath = "./OPC Foundation/CertificateStores/MachineDefault",
-                        SubjectName = Utils.Format("CN={0}, DC={1}", "UA Sample Client", Utils.GetHostName())
+                        StorePath = "OPC Foundation/CertificateStores/MachineDefault",
+                        SubjectName = "UA Core Sample Client"
                     },
                     TrustedPeerCertificates = new CertificateTrustList
                     {
                         StoreType = "Directory",
-                        StorePath = "./OPC Foundation/CertificateStores/UA Applications",
+                        StorePath = "OPC Foundation/CertificateStores/UA Applications",
                     },
                     TrustedIssuerCertificates = new CertificateTrustList
                     {
                         StoreType = "Directory",
-                        StorePath = "./OPC Foundation/CertificateStores/UA Certificate Authorities",
+                        StorePath = "OPC Foundation/CertificateStores/UA Certificate Authorities",
                     },
                     RejectedCertificateStore = new CertificateTrustList
                     {
                         StoreType = "Directory",
-                        StorePath = "./OPC Foundation/CertificateStores/RejectedCertificates",
+                        StorePath = "OPC Foundation/CertificateStores/RejectedCertificates",
                     },
                     NonceLength = 32,
                     AutoAcceptUntrustedCertificates = true
@@ -82,10 +83,28 @@ namespace NetCoreConsoleClient
                 TransportQuotas = new TransportQuotas { OperationTimeout = 15000 },
                 ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60000 }
             };
+
             await config.Validate(ApplicationType.Client);
 
             bool haveAppCertificate = config.SecurityConfiguration.ApplicationCertificate.Certificate != null;
 
+            if (!haveAppCertificate)
+            {
+                Console.WriteLine("    INFO: Create new application certificate: {0}", config.ApplicationName);
+
+                X509Certificate2 certificate = CertificateFactory.CreateCertificate(
+                    config.SecurityConfiguration.ApplicationCertificate.StoreType,
+                    config.SecurityConfiguration.ApplicationCertificate.StorePath,
+                    config.ApplicationUri,
+                    config.ApplicationName
+                    );
+
+                config.SecurityConfiguration.ApplicationCertificate.Certificate = certificate;
+
+            }
+
+            haveAppCertificate = config.SecurityConfiguration.ApplicationCertificate.Certificate != null;
+
             if (haveAppCertificate)
             {
                 config.ApplicationUri = Utils.GetApplicationUriFromCertificate(config.SecurityConfiguration.ApplicationCertificate.Certificate);
@@ -95,7 +114,7 @@ namespace NetCoreConsoleClient
                     config.CertificateValidator.CertificateValidation += new CertificateValidationEventHandler(CertificateValidator_CertificateValidation);
                 }
             }
-            if (!haveAppCertificate)
+            else
             {
                 Console.WriteLine("    WARN: missing application certificate, using unsecure connection.");
             }
@@ -104,6 +123,8 @@ namespace NetCoreConsoleClient
             Uri endpointURI = new Uri(endpointURL);
             var endpointCollection = DiscoverEndpoints(config, endpointURI, 10);
             var selectedEndpoint = SelectUaTcpEndpoint(endpointCollection, haveAppCertificate);
+            Console.WriteLine("    Selected endpoint uses: {0}", 
+                selectedEndpoint.SecurityPolicyUri.Substring(selectedEndpoint.SecurityPolicyUri.LastIndexOf('#') + 1));
 
             Console.WriteLine("3 - Create a session with OPC UA server.");
             var endpointConfiguration = EndpointConfiguration.Create(config);
diff --git a/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh b/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh
deleted file mode 100755
index 4dfdb8acaf..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleClient/createcert.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/bash
-# Create a UA Sample Client cert for OPC UA client
-#
-MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. `
-echo Create certificate $MYHOSTNAME for UA Sample Client
-openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=UA Sample Client" -nodes
-openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleclient.ext 
-openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass:
-openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER 
-openssl x509 -in $MYHOSTNAME.der -inform DER -text
-rm cert.*
-rm -rf "./OPC Foundation"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private"
-mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private"
-
diff --git a/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext b/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext
deleted file mode 100644
index b5e1daf044..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleClient/sampleclient.ext
+++ /dev/null
@@ -1,8 +0,0 @@
-# Extensions to add to a certificate request
-
-subjectKeyIdentifier=hash
-subjectAltName=URI:urn:localhost:OPCFoundation:SampleClient
-authorityKeyIdentifier=critical,keyid,issuer:always
-basicConstraints = critical, CA:FALSE
-keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
-extendedKeyUsage = critical, serverAuth, clientAuth
diff --git a/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd b/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd
deleted file mode 100644
index adcd89fdf4..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleServer/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Server" -dn %COMPUTERNAME% -sn "CN=UA Sample Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleServer" 
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml
index 3c58700050..08c5738add 100644
--- a/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml
+++ b/SampleApplications/Samples/NetCoreConsoleServer/Opc.Ua.SampleServer.Config.xml
@@ -4,8 +4,8 @@
   xmlns="http://opcfoundation.org/UA/SDK/Configuration.xsd"
   schemaLocation="./Schema/ApplicationConfiguration.xsd"
 >
-  <ApplicationName>Opc.Ua.SampleServer</ApplicationName>
-  <ApplicationUri>urn:localhost:OPCFoundation:SampleServer</ApplicationUri>
+  <ApplicationName>UA Core Sample Server</ApplicationName>
+  <ApplicationUri>urn:localhost:OPCFoundation:CoreSampleServer</ApplicationUri>
   <ProductUri>http://opcfoundation.org/UA/SampleServer</ProductUri>
   <ApplicationType>Server_0</ApplicationType>
 
@@ -15,7 +15,7 @@
     <ApplicationCertificate>
       <StoreType>Directory</StoreType>
       <StorePath>OPC Foundation/CertificateStores/MachineDefault</StorePath>
-      <SubjectName>UA Sample Server</SubjectName>
+      <SubjectName>UA Core Sample Server</SubjectName>
     </ApplicationCertificate>
 
     <!-- Where the issuer certificate are stored (certificate authorities) -->
@@ -180,9 +180,8 @@
   </Extensions>
 
   <TraceConfiguration>
-    <OutputFilePath>Logs/Opc.Ua.SampleServer.log.txt</OutputFilePath>
+    <OutputFilePath>./Logs/Opc.Ua.SampleServer.log.txt</OutputFilePath>
     <DeleteOnLoad>true</DeleteOnLoad>
-    <TraceMasks>0</TraceMasks>
     <!-- Show Only Errors -->
     <!-- <TraceMasks>1</TraceMasks> -->
     <!-- Show Only Security and Errors -->
diff --git a/SampleApplications/Samples/NetCoreConsoleServer/Program.cs b/SampleApplications/Samples/NetCoreConsoleServer/Program.cs
index 67f596a470..8b1d0e486e 100644
--- a/SampleApplications/Samples/NetCoreConsoleServer/Program.cs
+++ b/SampleApplications/Samples/NetCoreConsoleServer/Program.cs
@@ -124,7 +124,7 @@ namespace NetCoreConsoleServer
             ApplicationInstance.MessageDlg = new ApplicationMessageDlg();
             ApplicationInstance application = new ApplicationInstance();
 
-            application.ApplicationName = "UA Sample Server";
+            application.ApplicationName = "UA Core Sample Server";
             application.ApplicationType = ApplicationType.Server;
             application.ConfigSectionName = "Opc.Ua.SampleServer";
 
diff --git a/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh b/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh
deleted file mode 100755
index dde7b4d80a..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleServer/createcert.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/bash
-# Create a UA Sample Server cert for OPC UA server
-#
-MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. `
-echo Create certificate $MYHOSTNAME for UA Sample Server
-openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=UA Sample Server" -nodes
-openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleserver.ext 
-openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass:
-openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER 
-openssl x509 -in $MYHOSTNAME.der -inform DER -text
-rm cert.*
-rm -rf "./OPC Foundation"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private"
-mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private"
-
diff --git a/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext b/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext
deleted file mode 100644
index 66e611c66f..0000000000
--- a/SampleApplications/Samples/NetCoreConsoleServer/sampleserver.ext
+++ /dev/null
@@ -1,8 +0,0 @@
-# Extensions to add to a certificate request
-
-subjectKeyIdentifier=hash
-subjectAltName=URI:urn:localhost:OPCFoundation:SampleServer
-authorityKeyIdentifier=critical,keyid,issuer:always
-basicConstraints = critical, CA:FALSE
-keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
-extendedKeyUsage = critical, serverAuth, clientAuth
diff --git a/SampleApplications/Samples/Server.Net4/CreateCert.cmd b/SampleApplications/Samples/Server.Net4/CreateCert.cmd
deleted file mode 100644
index 1ede41b6d1..0000000000
--- a/SampleApplications/Samples/Server.Net4/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Server" -dn %COMPUTERNAME% -sn "CN=UA Sample Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleServer"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj
index d9e2fe1ebc..9a8fa5c2a8 100644
--- a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj	
+++ b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj	
@@ -163,7 +163,6 @@
     <Content Include="Opc.Ua.Sample.TestData.TestData.PredefinedNodes.uanodes">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </Content>
-    <None Include="CreateCert.cmd" />
   </ItemGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
diff --git a/SampleApplications/Samples/Server/App.xaml.cs b/SampleApplications/Samples/Server/App.xaml.cs
index f076749276..86808bf37f 100644
--- a/SampleApplications/Samples/Server/App.xaml.cs
+++ b/SampleApplications/Samples/Server/App.xaml.cs
@@ -3,6 +3,7 @@ using Windows.ApplicationModel;
 using Windows.ApplicationModel.Activation;
 using Windows.UI.Xaml;
 using Windows.UI.Xaml.Navigation;
+using Windows.Storage;
 using Opc.Ua.Configuration;
 using Opc.Ua.Client.Controls;
 using System.Threading.Tasks;
@@ -37,6 +38,10 @@ namespace Opc.Ua.SampleServer
             application.ApplicationType = ApplicationType.Server;
             application.ConfigSectionName = "Opc.Ua.SampleServer";
 
+            // helper to let Opc.Ua Utils find the localFolder in the environment
+            StorageFolder localFolder = ApplicationData.Current.LocalFolder;
+            Utils.DefaultLocalFolder = localFolder.Path;
+
             // set empty page for MessageDlg
             Window.Current.Content = new ServerPage();
 
diff --git a/SampleApplications/Samples/Server/CreateCert.cmd b/SampleApplications/Samples/Server/CreateCert.cmd
deleted file mode 100644
index 1ede41b6d1..0000000000
--- a/SampleApplications/Samples/Server/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "UA Sample Server" -dn %COMPUTERNAME% -sn "CN=UA Sample Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:OPCFoundation:SampleServer"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml
index 10adc467c0..7a6f7a8256 100644
--- a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml
+++ b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.Config.xml
@@ -14,26 +14,26 @@
     <!-- Where the application instance certificate is stored (MachineDefault) -->
     <ApplicationCertificate>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\MachineDefault</StorePath>
-      <SubjectName>UA Sample Server</SubjectName>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\MachineDefault</StorePath>
+      <SubjectName>Opc.Ua.SampleServer</SubjectName>
     </ApplicationCertificate>
 
     <!-- Where the issuer certificate are stored (certificate authorities) -->
     <TrustedIssuerCertificates>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\UA Certificate Authorities</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\UA Certificate Authorities</StorePath>
     </TrustedIssuerCertificates>
     
     <!-- Where the trust list is stored (UA Applications) -->
     <TrustedPeerCertificates>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\UA Applications</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\UA Applications</StorePath>
     </TrustedPeerCertificates>
     
     <!-- The directory used to store invalid certficates for later review by the administrator. -->
     <RejectedCertificateStore>
       <StoreType>Directory</StoreType>
-      <StorePath>OPC Foundation\CertificateStores\RejectedCertificates</StorePath>
+      <StorePath>%LocalFolder%\OPC Foundation\CertificateStores\RejectedCertificates</StorePath>
     </RejectedCertificateStore>
 
   </SecurityConfiguration>
@@ -55,7 +55,6 @@
   <ServerConfiguration>
     <BaseAddresses>
       <ua:String>opc.tcp://localhost:51210/UA/SampleServer</ua:String>
-      <ua:String>https://localhost:51212/UA/SampleServer/</ua:String>
     </BaseAddresses>
 
     <!-- 
@@ -79,7 +78,7 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
-        <SecurityLevel>3</SecurityLevel>
+        <SecurityLevel>4</SecurityLevel>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
@@ -99,7 +98,17 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
-        <SecurityLevel>4</SecurityLevel>
+        <SecurityLevel>5</SecurityLevel>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityLevel>3</SecurityLevel>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityLevel>6</SecurityLevel>
       </ServerSecurityPolicy>
     </SecurityPolicies>
 
@@ -107,25 +116,36 @@
     <MaxRequestThreadCount>100</MaxRequestThreadCount>
     <MaxQueuedRequestCount>2000</MaxQueuedRequestCount>
     
+    <!-- The SDK expects the server to support the same set of user tokens for every endpoint. -->
     <UserTokenPolicies>
+      <!-- Allows anonymous users -->
       <ua:UserTokenPolicy>
         <ua:TokenType>Anonymous_0</ua:TokenType>
         <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
+
+      <!-- Allows username/password -->
       <ua:UserTokenPolicy>
         <ua:TokenType>UserName_1</ua:TokenType>
+        <!-- passwords must be encrypted - this specifies what algorithm to use -->
+        <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
+
+      <!-- Allows user certificates -->
       <ua:UserTokenPolicy>
         <ua:TokenType>Certificate_2</ua:TokenType>
+        <!-- certificate possession must be proven with a digital signature - this specifies what algorithm to use -->
+        <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
       <!--
       <ua:UserTokenPolicy>
         <ua:TokenType>IssuedToken_3</ua:TokenType>
         <ua:IssuedTokenType>urn:oasis:names:tc:SAML:1.0:assertion:Assertion</ua:IssuedTokenType>
+        <ua:SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</ua:SecurityPolicyUri>
       </ua:UserTokenPolicy>
       -->
     </UserTokenPolicies>
-    <DiagnosticsEnabled>false</DiagnosticsEnabled>
+    <DiagnosticsEnabled>true</DiagnosticsEnabled>
     <MaxSessionCount>100</MaxSessionCount>
     <MinSessionTimeout>10000</MinSessionTimeout>
     <MaxSessionTimeout>3600000</MaxSessionTimeout>
@@ -166,12 +186,12 @@
   </Extensions>
 
   <TraceConfiguration>
-    <OutputFilePath>Logs\Opc.Ua.SampleServer.log.txt</OutputFilePath>
+    <OutputFilePath>%LocalFolder%\Logs\Opc.Ua.SampleServer.log.txt</OutputFilePath>
     <DeleteOnLoad>true</DeleteOnLoad>
     <!-- Show Only Errors -->
     <!-- <TraceMasks>1</TraceMasks> -->
     <!-- Show Only Security and Errors -->
-    <TraceMasks>515</TraceMasks>
+    <TraceMasks>513</TraceMasks>
     <!-- Show Only Security, Errors and Trace -->
     <!-- <TraceMasks>515</TraceMasks> -->
     <!-- Show Only Security, COM Calls, Errors and Trace -->
diff --git a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj
index f0ed64e8ef..8cdbe5155f 100644
--- a/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj
+++ b/SampleApplications/Samples/Server/Opc.Ua.SampleServer.csproj
@@ -103,7 +103,6 @@
     <Content Include="Opc.Ua.Sample.TestData.TestData.PredefinedNodes.uanodes">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </Content>
-    <None Include="CreateCert.cmd" />
     <None Include="Opc.Ua.SampleServer_TemporaryKey.pfx" />
     <None Include="project.json" />
     <None Include="project.lock.json" />
diff --git a/SampleApplications/Samples/Server/project.json b/SampleApplications/Samples/Server/project.json
index f485155aa6..25fecea223 100644
--- a/SampleApplications/Samples/Server/project.json
+++ b/SampleApplications/Samples/Server/project.json
@@ -1,5 +1,6 @@
 {
   "dependencies": {
+    "Portable.BouncyCastle": "1.8.1.2",
     "Microsoft.NETCore.UniversalWindowsPlatform": "5.2.2",
     "System.Xml.XmlDocument": "4.0.1"
   },
diff --git a/SampleApplications/Workshop/Reference/Client/CreateCert.cmd b/SampleApplications/Workshop/Reference/Client/CreateCert.cmd
deleted file mode 100644
index 993ebedfcb..0000000000
--- a/SampleApplications/Workshop/Reference/Client/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Client" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Client/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml b/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml
index c57a48812d..f2370a1238 100644
--- a/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml
+++ b/SampleApplications/Workshop/Reference/Client/Quickstarts.ReferenceClient.Config.xml
@@ -78,7 +78,7 @@
     <!-- Show Only Security and Errors -->
     <!-- <TraceMasks>513</TraceMasks> -->
     <!-- Show Only Security, Errors and Trace -->
-    <TraceMasks>515</TraceMasks>
+    <!-- <TraceMasks>515</TraceMasks> -->
     <!-- Show Only Security, COM Calls, Errors and Trace -->
     <!-- <TraceMasks>771</TraceMasks> -->
     <!-- Show Only Security, Service Calls, Errors and Trace -->
diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd
deleted file mode 100644
index fa723b8f5f..0000000000
--- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Server" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs
index 47bbf64d99..e538d2ac51 100644
--- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs
+++ b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Program.cs
@@ -131,7 +131,7 @@ namespace Quickstarts.ReferenceServer
             ApplicationConfiguration config = await application.LoadApplicationConfiguration(false);
 
             // check the application certificate.
-            bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(false, 0);
+            bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(false, CertificateFactory.defaultKeySize);
             if (!haveAppCertificate)
             {
                 throw new Exception("Application instance certificate invalid!");
diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml
index 40ad5e9dd0..9da804e869 100644
--- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml
+++ b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml
@@ -172,7 +172,7 @@
   </Extensions>
 
   <TraceConfiguration>
-    <OutputFilePath>Logs/Quickstarts.ReferenceServer.log.txt</OutputFilePath>
+    <OutputFilePath>./Logs/Quickstarts.ReferenceServer.log.txt</OutputFilePath>
     <DeleteOnLoad>true</DeleteOnLoad>
     <!-- Show Only Errors -->
     <!-- <TraceMasks>1</TraceMasks> -->
diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh
deleted file mode 100644
index 34e71f84f5..0000000000
--- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/createcert.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/bash
-# Create a cert
-#
-MYHOSTNAME=`echo $HOSTNAME | cut -f1 -d. `
-echo Create certificate $MYHOSTNAME for UA Sample Server
-openssl req -newkey rsa:1024 -out cert.crt -keyout cert.key -subj "/DC=$MYHOSTNAME/CN=Quickstart Reference Server" -nodes
-openssl x509 -days 365 -req -in cert.crt -signkey cert.key -out cert.pem -sha1 -extfile sampleserver.ext 
-openssl pkcs12 -export -in cert.pem -inkey cert.key -out $MYHOSTNAME.pfx -nodes -passout pass:
-openssl x509 -in cert.pem -out $MYHOSTNAME.der -outform DER 
-openssl x509 -in $MYHOSTNAME.der -inform DER -text
-rm cert.*
-rm -rf "./OPC Foundation"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mkdir -p "./OPC Foundation/CertificateStores/MachineDefault/private"
-mv $MYHOSTNAME.der "./OPC Foundation/CertificateStores/MachineDefault/certs"
-mv $MYHOSTNAME.pfx "./OPC Foundation/CertificateStores/MachineDefault/private"
-
diff --git a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext b/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext
deleted file mode 100644
index d63cc3fcf9..0000000000
--- a/SampleApplications/Workshop/Reference/ConsoleReferenceServer/sampleserver.ext
+++ /dev/null
@@ -1,8 +0,0 @@
-# Extensions to add to a certificate request
-
-subjectKeyIdentifier=hash
-subjectAltName=URI:urn:localhost:UA:Quickstarts:ReferenceServer
-authorityKeyIdentifier=critical,keyid,issuer:always
-basicConstraints = critical, CA:FALSE
-keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment, keyCertSign
-extendedKeyUsage = critical, serverAuth, clientAuth
diff --git a/SampleApplications/Workshop/Reference/Server/CreateCert.cmd b/SampleApplications/Workshop/Reference/Server/CreateCert.cmd
deleted file mode 100644
index fa723b8f5f..0000000000
--- a/SampleApplications/Workshop/Reference/Server/CreateCert.cmd
+++ /dev/null
@@ -1,10 +0,0 @@
-@echo off
-REM create the app certificate
-cd /D %~dp0
-set CERTSTORE=".\OPC Foundation\CertificateStores\MachineDefault"
-rd /S/Q %CERTSTORE%
-md %CERTSTORE%
-..\..\..\..\Opc.Ua.CertificateGenerator.exe -cmd issue -sp %CERTSTORE% -ks 2048 -an "Quickstart Reference Server" -dn %COMPUTERNAME% -sn "CN=Quickstart Reference Server/DC=%COMPUTERNAME%" -au "urn:%COMPUTERNAME%:UA:Quickstarts:ReferenceServer"
-set CERTSTORE=
-
-
diff --git a/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml b/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml
index 81127c91a8..3c0e1e7c12 100644
--- a/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml
+++ b/SampleApplications/Workshop/Reference/Server/Quickstarts.ReferenceServer.Config.xml
@@ -62,7 +62,7 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
-        <SecurityLevel>3</SecurityLevel>
+        <SecurityLevel>4</SecurityLevel>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
@@ -82,7 +82,17 @@
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
-        <SecurityLevel>4</SecurityLevel>
+        <SecurityLevel>5</SecurityLevel>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityLevel>3</SecurityLevel>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityLevel>6</SecurityLevel>
       </ServerSecurityPolicy>
     </SecurityPolicies>
 
@@ -122,7 +132,7 @@
     <MaxRequestAge>600000</MaxRequestAge>
     <MinPublishingInterval>100</MinPublishingInterval>
     <MaxPublishingInterval>3600000</MaxPublishingInterval>
-    <PublishingResolution>100</PublishingResolution>
+    <PublishingResolution>50</PublishingResolution>
     <MaxSubscriptionLifetime>3600000</MaxSubscriptionLifetime>
     <MaxMessageQueueSize>100</MaxMessageQueueSize>
     <MaxNotificationQueueSize>100</MaxNotificationQueueSize>
diff --git a/SampleApplications/Workshop/Reference/Server/Reference Server.csproj b/SampleApplications/Workshop/Reference/Server/Reference Server.csproj
index d02b060e44..7f2dfef9ce 100644
--- a/SampleApplications/Workshop/Reference/Server/Reference Server.csproj	
+++ b/SampleApplications/Workshop/Reference/Server/Reference Server.csproj	
@@ -161,8 +161,7 @@
   </ItemGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <PropertyGroup>
-    <PostBuildEvent>rmdir /s/q "$(TargetDir)OPC Foundation\CertificateStores\MachineDefault"
-mkdir "$(ProjectDir)OPC Foundation"
+    <PostBuildEvent>mkdir "$(ProjectDir)OPC Foundation"
 xcopy "$(ProjectDir)OPC Foundation\*.*" "$(TargetDir)OPC Foundation" /I/E/R/Y</PostBuildEvent>
   </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
diff --git a/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs b/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs
index 833de5afc2..fdc7ae81ba 100644
--- a/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs
+++ b/Stack/Opc.Ua.Core/Schema/ApplicationConfiguration.cs
@@ -1970,18 +1970,7 @@ namespace Opc.Ua
 
             set
             {
-                if (value.StartsWith(Directory.GetCurrentDirectory()) == true)
-                {
-                    m_storePath = value;
-                }
-                else
-                {
-                    m_storePath = Directory.GetCurrentDirectory();
-                    if (!String.IsNullOrEmpty(value))
-                    {
-                        m_storePath += Path.DirectorySeparatorChar + value;
-                    }
-                }
+                m_storePath = value;
 
                 if (!String.IsNullOrEmpty(m_storePath))
                 {
@@ -2237,18 +2226,7 @@ namespace Opc.Ua
 
             set
             {
-                if (value.StartsWith(Directory.GetCurrentDirectory()))
-                {
-                    m_storePath = value;
-                }
-                else
-                {
-                    m_storePath = Directory.GetCurrentDirectory();
-                    if (!String.IsNullOrEmpty(value))
-                    {
-                        m_storePath += Path.DirectorySeparatorChar + value;
-                    }
-                }
+                m_storePath = value;
 
                 if (!String.IsNullOrEmpty(m_storePath))
                 {
diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs
index 095e61ee29..641820768f 100644
--- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs
+++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateFactory.cs
@@ -13,10 +13,20 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Cryptography.X509Certificates;
-using System.Text;
+using System.Collections;
+using System.Globalization;
 using System.IO;
-using System.Threading.Tasks;
-using System.Diagnostics;
+using System.Text;
+using Org.BouncyCastle.Crypto;
+using Org.BouncyCastle.Asn1.X509;
+using Org.BouncyCastle.X509;
+using Org.BouncyCastle.Math;
+using Org.BouncyCastle.Utilities;
+using Org.BouncyCastle.Security;
+using Org.BouncyCastle.Crypto.Generators;
+using Org.BouncyCastle.Crypto.Operators;
+using Org.BouncyCastle.Pkcs;
+using Org.BouncyCastle.Asn1;
 
 namespace Opc.Ua
 {
@@ -25,6 +35,15 @@ namespace Opc.Ua
     /// </summary>
     public class CertificateFactory
     {
+        #region Public Constants
+        /// <summary>
+        /// The default certificate factory security parameter.
+        /// </summary>
+        public const ushort defaultKeySize = 2048;
+        public const ushort defaultHashSize = 256;
+        public const ushort defaultLifeTime = 120;
+        #endregion
+        #region Public Methods
         /// <summary>
         /// Creates a certificate from a buffer with DER encoded certificate.
         /// </summary>
@@ -84,11 +103,338 @@ namespace Opc.Ua
 
                 // save the key container so it can be deleted later.
                 m_temporaryKeyContainers.Add(certificate);
-        }
+            }
 
             return certificate;
         }
 
+        /// <summary>
+        /// Creates a self signed application instance certificate.
+        /// </summary>
+        /// <param name="storeType">Type of certificate store (Directory) <see cref="CertificateStoreType"/>.</param>
+        /// <param name="storePath">The store path (syntax depends on storeType).</param>
+        /// <param name="applicationUri">The application uri (created if not specified).</param>
+        /// <param name="applicationName">Name of the application (optional if subjectName is specified).</param>
+        /// <param name="subjectName">The subject used to create the certificate (optional if applicationName is specified).</param>
+        /// <param name="domainNames">The domain names that can be used to access the server machine (defaults to local computer name if not specified).</param>
+        /// <param name="keySize">Size of the key (1024, 2048 or 4096).</param>
+        /// <param name="lifetimeInMonths">The lifetime of the key in months.</param>
+        /// <param name="hashSizeInBits">The hash size in bits.</param>
+        /// <returns>The certificate with a private key.</returns>
+        public static X509Certificate2 CreateCertificate(
+            string storeType,
+            string storePath,
+            string applicationUri,
+            string applicationName,
+            string subjectName = null,
+            IList<string> serverDomainNames = null,
+            ushort keySize = defaultKeySize,
+            ushort lifetimeInMonths = defaultLifeTime,
+            ushort hashSizeInBits = defaultHashSize
+            )
+        {
+            return CreateCertificate(
+                storeType,
+                storePath,
+                null,
+                applicationUri,
+                applicationName,
+                subjectName,
+                serverDomainNames,
+                keySize,
+                DateTime.UtcNow,
+                lifetimeInMonths,
+                hashSizeInBits,
+                false,
+                null
+                );
+        }
+
+        /// <summary>
+        /// Creates a self signed application instance certificate.
+        /// </summary>
+        /// <param name="storeType">Type of certificate store (Directory) <see cref="CertificateStoreType"/>.</param>
+        /// <param name="storePath">The store path (syntax depends on storeType).</param>
+        /// <param name="password">The password to use to protect the certificate.</param>
+        /// <param name="applicationUri">The application uri (created if not specified).</param>
+        /// <param name="applicationName">Name of the application (optional if subjectName is specified).</param>
+        /// <param name="subjectName">The subject used to create the certificate (optional if applicationName is specified).</param>
+        /// <param name="domainNames">The domain names that can be used to access the server machine (defaults to local computer name if not specified).</param>
+        /// <param name="keySize">Size of the key (1024, 2048 or 4096).</param>
+        /// <param name="startTime">The start time.</param>
+        /// <param name="lifetimeInMonths">The lifetime of the key in months.</param>
+        /// <param name="hashSizeInBits">The hash size in bits.</param>
+        /// <param name="isCA">if set to <c>true</c> the a CA certificate is created.</param>
+        /// <param name="issuerCAKeyCert">The CA cert with the CA private key.</param>
+        /// <returns>The certificate with a private key.</returns>
+        public static X509Certificate2 CreateCertificate(
+            string storeType,
+            string storePath,
+            string password,
+            string applicationUri,
+            string applicationName,
+            string subjectName,
+            IList<String> domainNames,
+            ushort keySize,
+            DateTime startTime,
+            ushort lifetimeInMonths,
+            ushort hashSizeInBits,
+            bool isCA,
+            X509Certificate2 issuerCAKeyCert)
+        {
+            if (!String.IsNullOrEmpty(storeType) &&
+                storeType != CertificateStoreType.Directory)
+            {
+                throw new NotSupportedException("Cannot create a certificate for a non directory store.");
+            }
+
+            if (issuerCAKeyCert != null)
+            {
+                if (!issuerCAKeyCert.HasPrivateKey)
+                {
+                    throw new NotSupportedException("Cannot sign with a CA certificate without a private key.");
+                }
+
+                throw new NotSupportedException("Signing with an issuer CA certificate is unsupported yet.");
+            }
+
+            // set default values.
+            SetSuitableDefaults(
+                ref applicationUri,
+                ref applicationName,
+                ref subjectName,
+                ref domainNames,
+                ref keySize,
+                ref lifetimeInMonths,
+                isCA);
+
+            // cert generators
+            SecureRandom random = new SecureRandom();
+            X509V3CertificateGenerator cg = new X509V3CertificateGenerator();
+
+            // Serial Number
+            BigInteger serialNumber = BigIntegers.CreateRandomInRange(BigInteger.One, BigInteger.ValueOf(Int64.MaxValue), random);
+            cg.SetSerialNumber(serialNumber);
+
+            // build name attributes
+            var nameOids = new ArrayList();
+            nameOids.Add(X509Name.C);
+            //nameOids.Add(X509Name.O);
+            //nameOids.Add(X509Name.OU);
+            nameOids.Add(X509Name.DC);
+            nameOids.Add(X509Name.CN);
+
+            var nameValues = new ArrayList();
+            nameValues.Add(CultureInfo.CurrentCulture.TwoLetterISOLanguageName.ToUpper());
+            //nameValues.Add("OPC Foundation");
+            //nameValues.Add(unit);
+            nameValues.Add(domainNames[0]);
+            nameValues.Add(applicationName);
+
+            // self signed (TODO support issuer and subject)
+            X509Name subjectDN = new X509Name(nameOids, nameValues);
+            X509Name issuerDN = subjectDN;
+            cg.SetIssuerDN(issuerDN);
+            cg.SetSubjectDN(subjectDN);
+
+            // valid for
+            cg.SetNotBefore(startTime);
+            cg.SetNotAfter(startTime.AddMonths(lifetimeInMonths));
+
+            // Private/Public Key
+            AsymmetricCipherKeyPair subjectKeyPair;
+            var keyGenerationParameters = new KeyGenerationParameters(random, keySize);
+            var keyPairGenerator = new RsaKeyPairGenerator();
+            keyPairGenerator.Init(keyGenerationParameters);
+            subjectKeyPair = keyPairGenerator.GenerateKeyPair();
+            cg.SetPublicKey(subjectKeyPair.Public);
+
+            // add extensions
+            // Subject key identifier
+            cg.AddExtension(X509Extensions.SubjectKeyIdentifier.Id, false,
+                new SubjectKeyIdentifier(SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(subjectKeyPair.Public)));
+
+            // Basic constraints
+            cg.AddExtension(X509Extensions.BasicConstraints.Id, true, new BasicConstraints(isCA));
+
+            // Authority Key identifier
+            var issuerKeyPair = subjectKeyPair;
+            var issuerSerialNumber = serialNumber;
+            cg.AddExtension(X509Extensions.AuthorityKeyIdentifier.Id, false,
+                new AuthorityKeyIdentifier(SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(subjectKeyPair.Public),
+                    new GeneralNames(new GeneralName(issuerDN)), issuerSerialNumber));
+
+            if (!isCA)
+            {
+                // Key usage 
+                cg.AddExtension(X509Extensions.KeyUsage, true,
+                    new KeyUsage(KeyUsage.DataEncipherment | KeyUsage.DigitalSignature |
+                        KeyUsage.NonRepudiation | KeyUsage.KeyCertSign | KeyUsage.KeyEncipherment));
+
+                // Extended Key usage
+                cg.AddExtension(X509Extensions.ExtendedKeyUsage, true,
+                    new ExtendedKeyUsage(new List<DerObjectIdentifier>() {
+                    new DerObjectIdentifier("1.3.6.1.5.5.7.3.1"), // server auth
+                    new DerObjectIdentifier("1.3.6.1.5.5.7.3.2"), // client auth
+                    }));
+
+                // subject alternate name
+                cg.AddExtension(X509Extensions.SubjectAlternativeName, false,
+                    new GeneralNames(new GeneralName[] {
+                    new GeneralName(GeneralName.UniformResourceIdentifier, applicationUri),
+                    new GeneralName(GeneralName.DnsName, domainNames[0])}));
+            }
+            else
+            {
+                // Key usage CA
+                cg.AddExtension(X509Extensions.KeyUsage, true,
+                    new KeyUsage(KeyUsage.CrlSign | KeyUsage.DigitalSignature | KeyUsage.KeyCertSign));
+            }
+
+            // sign certificate
+            ISignatureFactory signatureFactory = 
+                new Asn1SignatureFactory((hashSizeInBits < 256) ? "SHA1WITHRSA" : "SHA256WITHRSA", subjectKeyPair.Private, random);
+            Org.BouncyCastle.X509.X509Certificate x509 = cg.Generate(signatureFactory);
+
+            // create pkcs12 store for cert and private key
+            MemoryStream pfxData = new MemoryStream();
+            Pkcs12Store pkcsStore = new Pkcs12StoreBuilder().Build();
+            X509CertificateEntry[] chain = new X509CertificateEntry[1];
+            chain[0] = new X509CertificateEntry(x509);
+            pkcsStore.SetKeyEntry(applicationName, new AsymmetricKeyEntry(subjectKeyPair.Private), chain);
+            pkcsStore.Save(pfxData, null, random);
+
+            // merge into X509Certificate2
+            X509Certificate2 certificate = new X509Certificate2(pfxData.ToArray(), (string)null, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.DefaultKeySet);
+
+            Utils.Trace("Created new cert: {0}", certificate.ToString());
+
+            // add cert to the store.
+            if (!String.IsNullOrEmpty(storePath))
+            {
+                ICertificateStore store = null;
+                if (storeType == CertificateStoreType.Directory)
+                {
+                    store = new Opc.Ua.DirectoryCertificateStore();
+                    store.Open(storePath);
+                    store.Add(certificate);
+                    store.Close();
+                }
+            }
+
+            // note: this cert has a private key!
+            return certificate;
+        }
+        #endregion
+        #region Private Methods
+        /// <summary>
+        /// Sets the parameters to suitable defaults.
+        /// </summary>
+        private static void SetSuitableDefaults(
+            ref string applicationUri,
+            ref string applicationName,
+            ref string subjectName,
+            ref IList<String> domainNames,
+            ref ushort keySize,
+            ref ushort lifetimeInMonths,
+            bool isCA)
+        {
+            // enforce recommended keysize unless lower value is enforced.
+            if (keySize < 1024)
+            {
+                keySize = defaultKeySize;
+            }
+
+            if (keySize % 1024 != 0)
+            {
+                throw new ArgumentNullException("keySize", "KeySize must be a multiple of 1024.");
+            }
+
+            // enforce minimum lifetime.
+            if (lifetimeInMonths < 1)
+            {
+                lifetimeInMonths = 1;
+            }
+
+            // parse the subject name if specified.
+            List<string> subjectNameEntries = null;
+
+            if (!String.IsNullOrEmpty(subjectName))
+            {
+                subjectNameEntries = Utils.ParseDistinguishedName(subjectName);
+            }
+
+            // check the application name.
+            if (String.IsNullOrEmpty(applicationName))
+            {
+                if (subjectNameEntries == null)
+                {
+                    throw new ArgumentNullException("applicationName", "Must specify a applicationName or a subjectName.");
+                }
+
+                // use the common name as the application name.
+                for (int ii = 0; ii < subjectNameEntries.Count; ii++)
+                {
+                    if (subjectNameEntries[ii].StartsWith("CN="))
+                    {
+                        applicationName = subjectNameEntries[ii].Substring(3).Trim();
+                        break;
+                    }
+                }
+            }
+
+            // remove special characters from name.
+            StringBuilder buffer = new StringBuilder();
+
+            for (int ii = 0; ii < applicationName.Length; ii++)
+            {
+                char ch = applicationName[ii];
+
+                if (Char.IsControl(ch) || ch == '/' || ch == ',' || ch == ';')
+                {
+                    ch = '+';
+                }
+
+                buffer.Append(ch);
+            }
+
+            applicationName = buffer.ToString();
+
+            // ensure at least one host name.
+            if (domainNames == null || domainNames.Count == 0)
+            {
+                domainNames = new List<string>();
+                domainNames.Add(Utils.GetHostName());
+            }
+
+            // create the application uri.
+            if (String.IsNullOrEmpty(applicationUri))
+            {
+                StringBuilder builder = new StringBuilder();
+
+                builder.Append("urn:");
+                builder.Append(domainNames[0]);
+                builder.Append(":");
+                builder.Append(applicationName);
+
+                applicationUri = builder.ToString();
+            }
+
+            Uri uri = Utils.ParseUri(applicationUri);
+
+            if (uri == null)
+            {
+                throw new ArgumentNullException("applicationUri", "Must specify a valid URL.");
+            }
+
+            // create the subject name,
+            if (String.IsNullOrEmpty(subjectName))
+            {
+                subjectName = Utils.Format("CN={0}/DC={1}", applicationName, domainNames[0]);
+            }
+        }
+        #endregion
+
         private static Dictionary<string, X509Certificate2> m_certificates = new Dictionary<string, X509Certificate2>();
         private static List<X509Certificate2> m_temporaryKeyContainers = new List<X509Certificate2>();
     }
diff --git a/Stack/Opc.Ua.Core/Security/Certificates/SecurityConfiguration.cs b/Stack/Opc.Ua.Core/Security/Certificates/SecurityConfiguration.cs
index 48ee5509dd..6aa6226594 100644
--- a/Stack/Opc.Ua.Core/Security/Certificates/SecurityConfiguration.cs
+++ b/Stack/Opc.Ua.Core/Security/Certificates/SecurityConfiguration.cs
@@ -47,7 +47,7 @@ namespace Opc.Ua
             {
                 RejectedCertificateStore = new CertificateStoreIdentifier();
                 RejectedCertificateStore.StoreType = CertificateStoreType.Directory;
-                RejectedCertificateStore.StorePath = Directory.GetCurrentDirectory() + Path.DirectorySeparatorChar + "Rejected";
+                RejectedCertificateStore.StorePath = Utils.DefaultLocalFolder + Path.DirectorySeparatorChar + "Rejected";
             }             
         }
 
diff --git a/Stack/Opc.Ua.Core/Stack/Configuration/ApplicationConfiguration.cs b/Stack/Opc.Ua.Core/Stack/Configuration/ApplicationConfiguration.cs
index 2cacee2e77..7506107ac9 100644
--- a/Stack/Opc.Ua.Core/Stack/Configuration/ApplicationConfiguration.cs
+++ b/Stack/Opc.Ua.Core/Stack/Configuration/ApplicationConfiguration.cs
@@ -505,7 +505,7 @@ namespace Opc.Ua
             {
                 filePath = m_clientConfiguration.EndpointCacheFilePath;
                 
-                if (!Path.IsPathRooted(filePath))
+                if (!Utils.IsPathRooted(filePath))
                 {
                     FileInfo sourceFile = new FileInfo(this.SourceFilePath);
                     filePath = Utils.Format("{0}{1}{2}", sourceFile.DirectoryName, Path.DirectorySeparatorChar, filePath);
diff --git a/Stack/Opc.Ua.Core/Types/Utils/Utils.cs b/Stack/Opc.Ua.Core/Types/Utils/Utils.cs
index f8f3653b32..0bb48c33b3 100644
--- a/Stack/Opc.Ua.Core/Types/Utils/Utils.cs
+++ b/Stack/Opc.Ua.Core/Types/Utils/Utils.cs
@@ -26,6 +26,7 @@ using System.Diagnostics;
 using System.Security.Cryptography;
 using System.Net;
 
+
 namespace Opc.Ua
 {
     /// <summary>
@@ -70,10 +71,15 @@ namespace Opc.Ua
         /// The default certificate store's type.
         /// </summary>
         public const string DefaultStoreType = CertificateStoreType.Directory;
+
+        /// <summary>
+        /// The default LocalFolder.
+        /// </summary>
+        public static string DefaultLocalFolder = Directory.GetCurrentDirectory();
         #endregion
-                
+
         #region Trace Support
-        #if DEBUG
+#if DEBUG
         private static int s_traceOutput = (int)TraceOutput.DebugAndFile;
         private static int s_traceMasks = (int)TraceMasks.All;
         #else
@@ -422,6 +428,15 @@ namespace Opc.Ua
         #endregion
 
         #region File Access
+        /// <summary>
+        /// Replaces a prefix enclosed in '%' with a special folder or environment variable path (e.g. %ProgramFiles%\MyCompany).
+        /// </summary>
+        public static bool IsPathRooted(string path)
+        {
+            // allow for local file locations
+            return Path.IsPathRooted(path) || path[0] == '.';
+        }
+
         /// <summary>
         /// Replaces a prefix enclosed in '%' with a special folder or environment variable path (e.g. %ProgramFiles%\MyCompany).
         /// </summary>
@@ -434,7 +449,7 @@ namespace Opc.Ua
             }
 
             // check for absolute path.
-            if (Path.IsPathRooted(input))
+            if (Utils.IsPathRooted(input))
             {
                 return input;
             }
@@ -469,7 +484,14 @@ namespace Opc.Ua
             {
                 buffer.Append(value);
             }
-                       
+            else
+            {
+                if (folder == "LocalFolder")
+                {
+                    buffer.Append(DefaultLocalFolder);
+                }
+            }
+
             // construct new path.
             buffer.Append(path);
             return buffer.ToString();
@@ -533,7 +555,7 @@ namespace Opc.Ua
                 FileInfo file = new FileInfo(filePath);
 
                 // check for absolute path.
-                bool isAbsolute = Path.IsPathRooted(filePath);
+                bool isAbsolute = Utils.IsPathRooted(filePath);
                 
                 if (isAbsolute)
                 {
@@ -647,7 +669,7 @@ namespace Opc.Ua
                 DirectoryInfo directory = new DirectoryInfo(dirPath);
 
                 // check for absolute path.
-                bool isAbsolute = Path.IsPathRooted(dirPath);
+                bool isAbsolute = Utils.IsPathRooted(dirPath);
                 
                 if (isAbsolute)
                 {
diff --git a/Stack/Opc.Ua.Core/project.json b/Stack/Opc.Ua.Core/project.json
index be6eb77546..1410f6f202 100644
--- a/Stack/Opc.Ua.Core/project.json
+++ b/Stack/Opc.Ua.Core/project.json
@@ -2,9 +2,9 @@
     "version": "1.0.0-*",
 
   "dependencies": {
+    "Portable.BouncyCastle": "1.8.1.2",
     "NETStandard.Library": "1.6.0",
     "Newtonsoft.Json": "9.0.1",
-    "Portable.BouncyCastle": "1.8.1.1",
     "System.Data.Common": "4.1.0",
     "System.Private.ServiceModel": "4.1.0",
     "System.ServiceModel.Primitives": "4.1.0"
@@ -24,9 +24,9 @@
             }
         },
         "uap10.0": {
-            "dependencies": {
-                "System.Net.NameResolution": "4.0.0"
-            },
+          "dependencies": {
+            "System.Net.NameResolution": "4.0.0"
+          },
             "buildOptions": {
                 "define": [ "NO_HTTPS" ]
             }