IOP workshop 2021 fixes and build improvements (#1562)

-fixes for complex types: - a structure which contains an enum from namespace 0 can not be created. fixes #1561. - a structure with multidimensional array may lead to a endless loop in `ComplexTypeSystem.Load` - a malformed namespace Uri which contains a space character prevents creation of type system. - select endpoint doesn't pick the right scheme if the default endpoint must be picked -prep for net472 or greater and net5.0 or greater build, only build #ifdef
2026-10-17 05:11:13 +08:00 · 2021-10-29 16:21:43 +02:00
parent ed434e9a17
commit 53ec78f1bc
41 changed files with 109 additions and 71 deletions
@@ -369,7 +369,7 @@ namespace Opc.Ua.Client.Controls
            InternalDisconnect();

            // select the best endpoint.
-            var endpointDescription = CoreClientUtils.SelectEndpoint(serverUrl, useSecurity, DiscoverTimeout);
+            var endpointDescription = CoreClientUtils.SelectEndpoint(m_configuration, serverUrl, useSecurity, DiscoverTimeout);
            var endpointConfiguration = EndpointConfiguration.Create(m_configuration);
            var endpoint = new ConfiguredEndpoint(null, endpointDescription, endpointConfiguration);

@@ -565,7 +565,7 @@ namespace Opc.Ua.Client.Controls
                }

                // return the selected endpoint.
-                return CoreClientUtils.SelectEndpoint(discoveryUrl, UseSecurityCK.Checked, DiscoverTimeout);
+                return CoreClientUtils.SelectEndpoint(m_configuration, discoveryUrl, UseSecurityCK.Checked, DiscoverTimeout);
            }
            finally
            {
@@ -84,8 +84,7 @@ namespace Quickstarts.ConsoleReferenceClient

                    // Get the endpoint by connecting to server's discovery endpoint.
                    // Try to find the first endopint without security.
-                    EndpointDescription endpointDescription = CoreClientUtils.SelectEndpoint(ServerUrl, false);
-
+                    EndpointDescription endpointDescription = CoreClientUtils.SelectEndpoint(m_configuration, ServerUrl, false);
                    EndpointConfiguration endpointConfiguration = EndpointConfiguration.Create(m_configuration);
                    ConfiguredEndpoint endpoint = new ConfiguredEndpoint(null, endpointDescription, endpointConfiguration);

@@ -617,7 +617,6 @@ namespace Opc.Ua.Client.ComplexTypes
                                catch (DataTypeNotSupportedException dtnsex)
                                {
                                    Utils.Trace(dtnsex, "Skipped the type definition of {0} because it is not supported.", dataTypeNode.BrowseName.Name);
-                                    continue;
                                }
                                catch
                                {
@@ -647,6 +646,10 @@ namespace Opc.Ua.Client.ComplexTypes
                    structTypesWorkList = structTypesToDoList;
                    structTypesToDoList = new List<INode>();
                }
+                else
+                {
+                    break;
+                }
            } while (retryAddStructType);

            // all types loaded
@@ -897,7 +900,7 @@ namespace Opc.Ua.Client.ComplexTypes
        private IList<INode> RemoveKnownTypes(IList<INode> nodeList)
        {
            return nodeList.Where(
-                node => GetSystemType(node.NodeId) == null).ToList();
+                node => GetSystemType(node.NodeId) == null).Distinct().ToList();
        }

        /// <summary>
@@ -1170,6 +1173,13 @@ namespace Opc.Ua.Client.ComplexTypes
                }
                if (superType.NamespaceIndex == 0)
                {
+                    if (superType == DataTypeIds.Enumeration &&
+                        dataType.NamespaceIndex == 0)
+                    {
+                        // enumerations of namespace 0 in a structure
+                        // which are not in the type system are encoded as UInt32
+                        return new NodeId((uint)BuiltInType.UInt32);
+                    }
                    if (superType == DataTypeIds.Enumeration ||
                        superType == DataTypeIds.Structure)
                    {
@@ -207,7 +207,9 @@ namespace Opc.Ua.Client.ComplexTypes
        {
            if (String.IsNullOrWhiteSpace(moduleName))
            {
-                Uri uri = new Uri(targetNamespace, UriKind.RelativeOrAbsolute);
+                // remove space chars in malformed namespace url
+                var tempNamespace = targetNamespace.Replace(" ", "");
+                Uri uri = new Uri(tempNamespace, UriKind.RelativeOrAbsolute);
                var tempName = uri.IsAbsoluteUri ? uri.AbsolutePath : uri.ToString();

                tempName = tempName.Replace("/", "");
@@ -29,6 +29,7 @@

 using System;
 using System.Collections.Generic;
+using System.Linq;

 namespace Opc.Ua.Client
 {
@@ -296,7 +297,7 @@ namespace Opc.Ua.Client
            // pick the first available endpoint by default.
            if (selectedEndpoint == null && endpoints.Count > 0)
            {
-                selectedEndpoint = endpoints[0];
+                selectedEndpoint = endpoints.FirstOrDefault(e => e.EndpointUrl?.StartsWith(url.Scheme) == true);
            }

            // return the selected endpoint.
@@ -525,9 +525,7 @@ namespace Opc.Ua.Configuration

            return true;
        }
-        #endregion

-        #region Private Methods
        /// <summary>
        /// Helper to suppress errors which are allowed for the application certificate validation.
        /// </summary>
@@ -812,9 +810,12 @@ namespace Opc.Ua.Configuration
                    thumbprint = certificate.Thumbprint;
                }

-                using (ICertificateStore store = configuration.SecurityConfiguration.TrustedPeerCertificates.OpenStore())
+                if (!string.IsNullOrEmpty(thumbprint))
                {
-                    await store.Delete(thumbprint).ConfigureAwait(false);
+                    using (ICertificateStore store = configuration.SecurityConfiguration.TrustedPeerCertificates.OpenStore())
+                    {
+                        await store.Delete(thumbprint).ConfigureAwait(false);
+                    }
                }
            }

@@ -963,6 +963,7 @@ namespace Opc.Ua.Gds.Client
        }

        #endregion
+
        #region Private Fields
        private ConfiguredEndpoint m_endpoint;
        #endregion
@@ -1,4 +1,4 @@
-/* ========================================================================
+/* ========================================================================
 * Copyright (c) 2005-2020 The OPC Foundation, Inc. All rights reserved.
 *
 * OPC Foundation MIT License 1.00
@@ -32,9 +32,11 @@ using System.IO;
 using System.Runtime.Serialization;
 using System.Runtime.Serialization.Formatters.Binary;

+#if !NET5_0_OR_GREATER
 namespace Opc.Ua.Gds.Server.Database.Linq
 {
    [Serializable]
+    [Obsolete("Do not use. Binary decoding poses a security risk.")]
    public class BinaryApplicationsDatabase : LinqApplicationsDatabase
    {
        #region Constructors
@@ -60,6 +62,7 @@ namespace Opc.Ua.Gds.Server.Database.Linq
            }
        }
        #endregion
+
        #region Public Members
        public override void Save()
        {
@@ -71,9 +74,11 @@ namespace Opc.Ua.Gds.Server.Database.Linq
        }
        public string FileName { get { return m_fileName; } private set { m_fileName = value; } }
        #endregion
+
        #region Private Fields
        [NonSerialized]
        string m_fileName;
        #endregion
    }
 }
+#endif
@@ -272,7 +272,7 @@ namespace Opc.Ua.Security.Certificates
            }
        }

-#if NETSTANDARD2_1 || NET472 || NET5_0
+#if NETSTANDARD2_1 || NET472_OR_GREATER || NET5_0_OR_GREATER
        /// <summary>
        /// Encode the Subject Alternative name extension.
        /// </summary>
@@ -26,7 +26,7 @@
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/
-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography;
@@ -10,7 +10,7 @@
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER
 using System;
 using System.Security.Cryptography;
 using Org.BouncyCastle.Crypto.Prng;
@@ -10,7 +10,7 @@
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 using Org.BouncyCastle.Asn1.X509;

@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if !NETSTANDARD2_1 && !NET5_0
+#if !NETSTANDARD2_1 && !NET5_0_OR_GREATER
 using System;
 using System.Security.Cryptography;
 using System.IO;
@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if !NETSTANDARD2_1 && !NET5_0
+#if !NETSTANDARD2_1 && !NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography.X509Certificates;
@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 using System;
 using System.Collections.Generic;
@@ -26,7 +26,7 @@
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/
-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography;
@@ -10,7 +10,7 @@
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

-#if !NETSTANDARD2_1 && !NET5_0
+#if !NETSTANDARD2_1 && !NET5_0_OR_GREATER
 using System;
 using System.IO;
 using System.Linq;
@@ -20,7 +20,6 @@ using Org.BouncyCastle.Asn1.X509;
 using Org.BouncyCastle.Crypto;
 using Org.BouncyCastle.Crypto.Parameters;
 using Org.BouncyCastle.Math;
-using Org.BouncyCastle.OpenSsl;
 using Org.BouncyCastle.Pkcs;
 using Org.BouncyCastle.Security;

@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if NETSTANDARD2_1 || NET5_0
+#if NETSTANDARD2_1 || NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography;
@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if NETSTANDARD2_1 || NET5_0
+#if NETSTANDARD2_1 || NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography.X509Certificates;
@@ -1,7 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.

-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 // This source code is intentionally copied from the .NET core runtime to close
 // a gap in the .NET 4.6 and the .NET Core 2.x runtime implementations.
@@ -1,7 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.

-#if !NETSTANDARD2_1 && !NET472 && !NET5_0
+#if !NETSTANDARD2_1 && !NET472_OR_GREATER && !NET5_0_OR_GREATER

 // This source code is intentionally copied from the .NET core runtime to close
 // a gap in the .NET 4.6 and the .NET Core 2.x runtime implementations.
@@ -27,7 +27,7 @@
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

-#if NETSTANDARD2_1 || NET472 || NET5_0
+#if NETSTANDARD2_1 || NET472_OR_GREATER || NET5_0_OR_GREATER

 using System;
 using System.Security.Cryptography;
@@ -268,13 +268,14 @@ namespace Opc.Ua.Security.Certificates
        public override ICertificateBuilderCreateForECDsaAny SetECDsaPublicKey(byte[] publicKey)
        {
            if (publicKey == null) throw new ArgumentNullException(nameof(publicKey));
+#if NET472_OR_GREATER
+            throw new NotSupportedException("Import a ECDsaPublicKey is not supported on this platform.");
+#else
            int bytes = 0;
            try
            {
                m_ecdsaPublicKey = ECDsa.Create();
-#if !NET472  // TODO
                m_ecdsaPublicKey.ImportSubjectPublicKeyInfo(publicKey, out bytes);
-#endif
            }
            catch (Exception e)
            {
@@ -286,6 +287,7 @@ namespace Opc.Ua.Security.Certificates
                throw new ArgumentException("Decoded the public key but extra bytes were found.");
            }
            return this;
+#endif
        }
 #endif

@@ -293,13 +295,14 @@ namespace Opc.Ua.Security.Certificates
        public override ICertificateBuilderCreateForRSAAny SetRSAPublicKey(byte[] publicKey)
        {
            if (publicKey == null) throw new ArgumentNullException(nameof(publicKey));
+#if NET472_OR_GREATER
+            throw new NotSupportedException("Import a ECDsaPublicKey is not supported on this platform.");
+#else
            int bytes = 0;
            try
            {
                m_rsaPublicKey = RSA.Create();
-#if !NET472  // TODO
                m_rsaPublicKey.ImportSubjectPublicKeyInfo(publicKey, out bytes);
-#endif
            }
            catch (Exception e)
            {
@@ -311,6 +314,7 @@ namespace Opc.Ua.Security.Certificates
                throw new ArgumentException("Decoded the public key but extra bytes were found.");
            }
            return this;
+#endif
        }
        #endregion

@@ -10,7 +10,6 @@
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

-
 using System;
 using System.Linq;
 using System.Security.Cryptography;
@@ -22,11 +22,18 @@
    <Reference Include="System.Net.Http" />
  </ItemGroup>

+  <ItemGroup Condition="'$(TargetFramework)' == 'net472'">
+    <Reference Include="System.Net.Http" />
+  </ItemGroup>
+
  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Core" Version="2.1.25" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Https" Version="2.1.3" />
+    <PackageReference Include="System.Io.Pipelines" Version="4.5.4" />
+    <PackageReference Include="System.Text.Encodings.Web" Version="4.5.1" />
+    
  </ItemGroup>

  <ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
@@ -38,6 +38,7 @@

  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+    <PackageReference Include="System.Buffers" Version="4.5.1" />
  </ItemGroup>

  <ItemGroup>
@@ -281,7 +281,7 @@ namespace Opc.Ua
            return new X509CRL(crlBuilder.CreateForRSA(issuerCertificate));
        }

-#if NETSTANDARD2_1 || NET5_0
+#if NETSTANDARD2_1 || NET472_OR_GREATER || NET5_0_OR_GREATER
        /// <summary>
        /// Creates a certificate signing request from an existing certificate.
        /// </summary>
@@ -139,9 +139,7 @@ namespace Opc.Ua
            get { return m_validationOptions; }
            set { m_validationOptions = value; }
        }
-        #endregion

-        #region Public Methods
        /// <summary>
        /// Gets or sets the actual certificate.
        /// </summary>
@@ -151,7 +149,9 @@ namespace Opc.Ua
            get { return m_certificate; }
            set { m_certificate = value; }
        }
+        #endregion

+        #region Public Methods
        /// <summary>
        /// Finds a certificate in a store.
        /// </summary>
@@ -446,7 +446,7 @@ namespace Opc.Ua
        }

        /// <summary>
-        /// recursively checks whether any of the service results or inner service results
+        /// Recursively checks whether any of the service results or inner service results
        /// of the input sr must not be suppressed.
        /// The list of supressible status codes is - for backwards compatibiliyt - longer
        /// than the spec would imply.
@@ -496,7 +496,18 @@ namespace Opc.Ua
                        try
                        {
                            store.Delete(certificate.Thumbprint);
-                            store.Add(certificate);
+                            // save only public key
+                            if (certificate.HasPrivateKey)
+                            {
+                                using (var cert = new X509Certificate2(certificate.RawData))
+                                {
+                                    store.Add(cert);
+                                }
+                            }
+                            else
+                            {
+                                store.Add(certificate);
+                            }
                        }
                        finally
                        {
@@ -340,6 +340,7 @@ namespace Opc.Ua
                return false;
            }
        }
+
        /// <summary>
        /// Lazy helper to allow runtime to check for Pss support.
        /// </summary>
@@ -130,7 +130,7 @@ namespace Opc.Ua
                store.Open(OpenFlags.ReadWrite);
                if (!store.Certificates.Contains(certificate))
                {
-#if NETSTANDARD2_1 || NET5_0
+#if NETSTANDARD2_1 || NET5_0_OR_GREATER
                    if (certificate.HasPrivateKey &&
                        (Environment.OSVersion.Platform == PlatformID.Win32NT))
                    {
@@ -56,6 +56,7 @@ namespace Opc.Ua
        }
        #endregion
    }
+
    /// <summary>
    /// Represents the location of a configuration file.
    /// </summary>
@@ -616,10 +616,7 @@ namespace Opc.Ua
            {
                PushNamespace(Namespaces.OpcUaXsd);

-                if (value != null)
-                {
-                    WriteUInt32("Code", value.Code);
-                }
+                WriteUInt32("Code", value.Code);

                PopNamespace();

@@ -67,6 +67,7 @@ namespace Opc.Ua.Client.Tests
        Session m_session;
        OperationLimits m_operationLimits;
        string m_uriScheme;
+        string m_pkiRoot;
        Uri m_url;

        public ClientTest(string uriScheme = Utils.UriSchemeOpcTcp)
@@ -96,6 +97,9 @@ namespace Opc.Ua.Client.Tests
        /// <param name="writer">The test output writer.</param>
        public async Task OneTimeSetUpAsync(TextWriter writer = null)
        {
+            // pki directory root for test runs. 
+            m_pkiRoot = Path.GetTempPath() + Path.GetRandomFileName();
+
            // start Ref server
            m_serverFixture = new ServerFixture<ReferenceServer> {
                UriScheme = m_uriScheme,
@@ -107,10 +111,10 @@ namespace Opc.Ua.Client.Tests
            {
                m_serverFixture.TraceMasks = Utils.TraceMasks.Error;
            }
-            m_server = await m_serverFixture.StartAsync(writer ?? TestContext.Out).ConfigureAwait(false);
+            m_server = await m_serverFixture.StartAsync(writer ?? TestContext.Out, m_pkiRoot).ConfigureAwait(false);

            m_clientFixture = new ClientFixture();
-            await m_clientFixture.LoadClientConfiguration().ConfigureAwait(false);
+            await m_clientFixture.LoadClientConfiguration(m_pkiRoot).ConfigureAwait(false);
            m_clientFixture.Config.TransportQuotas.MaxMessageSize =
            m_clientFixture.Config.TransportQuotas.MaxBufferSize = 4 * 1024 * 1024;
            m_url = new Uri(m_uriScheme + "://localhost:" + m_serverFixture.Port.ToString());
@@ -943,12 +943,12 @@ namespace Opc.Ua.Core.Tests.Security.Certificates
        }

        /// <summary>
-        /// Validate Sha1 signed certificates cause a policy check failed.
+        /// Validate SHA1 signed certificates cause a policy check failed.
        /// </summary>
        [Theory]
        public async Task TestSHA1Rejected(bool trusted, bool rejectSHA1)
        {
-#if NETCOREAPP3_1_OR_GREATER
+#if NET472_OR_GREATER || NETCOREAPP3_1_OR_GREATER
            Assert.Ignore("SHA1 is unsupported on .NET Core 3.1");
 #endif
            var cert = CertificateFactory.CreateCertificate(null, null, "CN=SHA1 signed", null)
@@ -62,7 +62,6 @@ namespace Opc.Ua.Gds.Tests
            {
                return $"{SecurityProfileUri.Split('#').Last()}:{MessageSecurityMode}";
            }
-
        }

        /// <summary>
@@ -34,10 +34,8 @@ using Opc.Ua.Configuration;
 using Opc.Ua.Gds.Server;
 using Opc.Ua.Gds.Server.Database.Linq;

-
 namespace Opc.Ua.Gds.Tests
 {
-
    public class GlobalDiscoveryTestServer
    {
        public GlobalDiscoverySampleServer Server => m_server;
@@ -45,7 +43,6 @@ namespace Opc.Ua.Gds.Tests
        public ApplicationConfiguration Config { get; private set; }
        public int BasePort { get; private set; }

-
        public GlobalDiscoveryTestServer(bool _autoAccept)
        {
            m_autoAccept = _autoAccept;
@@ -54,8 +51,7 @@ namespace Opc.Ua.Gds.Tests
        public async Task StartServer(bool clean, int basePort = -1)
        {
            ApplicationInstance.MessageDlg = new ApplicationMessageDlg();
-            Application = new ApplicationInstance
-            {
+            Application = new ApplicationInstance {
                ApplicationName = "Global Discovery Server",
                ApplicationType = ApplicationType.Server,
                ConfigSectionName = "Opc.Ua.GlobalDiscoveryTestServer"
@@ -131,7 +127,6 @@ namespace Opc.Ua.Gds.Tests
            {
                throw new ServiceResultException("Server failed to start");
            }
-
        }

        public void StopServer()
@@ -147,7 +142,6 @@ namespace Opc.Ua.Gds.Tests
                    server.Stop();
                }
            }
-
        }

        public string ReadLogFile()
@@ -189,15 +183,14 @@ namespace Opc.Ua.Gds.Tests

        private async Task<ApplicationConfiguration> Load(ApplicationInstance application, int basePort)
        {
-#if USE_FILE_CONFIG
+#if !USE_FILE_CONFIG
            // load the application configuration.
            ApplicationConfiguration config = await application.LoadApplicationConfiguration(true).ConfigureAwait(false);
 #else
-            string gdsRoot = "%LocalApplicationData%/OPC/GDS";
-            var gdsConfig = new GlobalDiscoveryServerConfiguration()
-            {
-                AuthoritiesStorePath = gdsRoot + "/authorities",
-                ApplicationCertificatesStorePath = gdsRoot + "/applications",
+            string gdsRoot = Path.Combine("%LocalApplicationData%", "OPC", "GDS");
+            var gdsConfig = new GlobalDiscoveryServerConfiguration() {
+                AuthoritiesStorePath = Path.Combine(gdsRoot, "authorities"),
+                ApplicationCertificatesStorePath = Path.Combine(gdsRoot, "applications"),
                DefaultSubjectNameContext = "O=OPC Foundation",
                CertificateGroups = new CertificateGroupConfigurationCollection()
                {
@@ -206,7 +199,7 @@ namespace Opc.Ua.Gds.Tests
                        Id = "Default",
                        CertificateType ="RsaSha256ApplicationCertificateType",
                        SubjectName = "CN=GDS Test CA, O=OPC Foundation",
-                        BaseStorePath = gdsRoot + "/CA/default",
+                        BaseStorePath = Path.Combine(gdsRoot, "CA", "default"),
                        DefaultCertificateHashSize = 256,
                        DefaultCertificateKeySize = 2048,
                        DefaultCertificateLifetime = 12,
@@ -4,10 +4,13 @@
    <OutputType>Exe</OutputType>
    <TargetFrameworks>$(TestsTargetFrameworks)</TargetFrameworks>
    <RootNamespace>Opc.Ua.Gds.Tests</RootNamespace>
-    <DefineConstants>$(DefineConstants);USE_FILE_CONFIG</DefineConstants>
    <GenerateProgramFile>false</GenerateProgramFile>
  </PropertyGroup>

+  <PropertyGroup Condition="'$(TargetFramework)' == 'net462'">
+    <DefineConstants>$(DefineConstants);USE_FILE_CONFIG</DefineConstants>
+  </PropertyGroup>
+
  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0" />
    <PackageReference Include="NUnit" Version="3.13.2" />
@@ -278,8 +278,8 @@ namespace Opc.Ua.Gds.Tests
        [Test, Order(402)]
        public void CreateSigningRequestRsaMinNullParms()
        {
-#if NETSTANDARD2_1 || NET5_0
-            Assert.Ignore("SHA1 not supported on .NET Standard 2.1.");
+#if NETSTANDARD2_1 || NET5_0_OR_GREATER
+            Assert.Ignore("SHA1 not supported on .NET Standard 2.1 and .NET 5.0 or greater");
 #endif
            ConnectPushClient(true);
            Assert.That(() => { m_pushClient.PushClient.CreateSigningRequest(null, OpcUa.ObjectTypeIds.RsaMinApplicationCertificateType, null, false, null); }, Throws.Exception);
@@ -350,7 +350,7 @@ namespace Opc.Ua.Security.Certificates.Tests
            }
        }

-#if NET462_OR_GREATER || NETCOREAPP3_1_OR_GREATER
+#if NETFRAMEWORK || NETCOREAPP3_1
        [Test]
        public void CreateIssuerRSACngWithSuppliedKeyPair()
        {
@@ -54,7 +54,7 @@ namespace Opc.Ua.Server.Tests
        /// <summary>
        /// Start server fixture on random or fixed port.
        /// </summary>
-        public async Task<T> StartAsync(TextWriter writer, int port = 0)
+        public async Task<T> StartAsync(TextWriter writer, string pkiRoot = null, int port = 0)
        {
            Random m_random = new Random();
            bool retryStartServer = false;
@@ -71,7 +71,7 @@ namespace Opc.Ua.Server.Tests
            {
                try
                {
-                    await InternalStartServerAsync(writer, testPort).ConfigureAwait(false);
+                    await InternalStartServerAsync(writer, testPort, pkiRoot).ConfigureAwait(false);
                }
                catch (ServiceResultException sre)
                {
@@ -93,7 +93,7 @@ namespace Opc.Ua.Server.Tests
        /// <summary>
        /// Create the configuration and start the server.
        /// </summary>
-        private async Task InternalStartServerAsync(TextWriter writer, int port)
+        private async Task InternalStartServerAsync(TextWriter writer, int port, string pkiRoot = null)
        {
            ApplicationInstance application = new ApplicationInstance {
                ApplicationName = typeof(T).Name,
@@ -101,7 +101,7 @@ namespace Opc.Ua.Server.Tests
            };

            // create the application configuration. Use temp path for cert stores.
-            var pkiRoot = Path.GetTempPath() + Path.GetRandomFileName();
+            pkiRoot = pkiRoot ?? Path.GetTempPath() + Path.GetRandomFileName();
            var endpointUrl = $"{UriScheme}://localhost:{port}/" + typeof(T).Name;
            var serverConfig = application.Build(
                "urn:localhost:UA:" + typeof(T).Name,
@@ -7,7 +7,7 @@
    <Copyright>Copyright © 2004-2021 OPC Foundation, Inc</Copyright>
    <Company>OPC Foundation</Company>
    <Authors>OPC Foundation</Authors>
-    <NoWarn>NU5125;RCS1138;RCS1139</NoWarn>
+    <NoWarn>NU5125;RCS1138;RCS1139;NETSDK1138</NoWarn>
    <NeutralLanguage>en-US</NeutralLanguage>
    <HighEntropyVA>true</HighEntropyVA>
    <IsPackable>false</IsPackable>