From 75d8b2ca3ca3c8254edd47ef4f3db30fcc304ff6 Mon Sep 17 00:00:00 2001
From: Martin Regen <mregen@microsoft.com>
Date: Tue, 20 Feb 2018 11:27:00 +0100
Subject: [PATCH] Fix .Net 4.6 Https client and server (#359)

- best possible fix for #189 to reenable https servers
- `UA Sample Client` and `UA Sample Server` expose https server. libuv.dll is by default for x64. Change
```
<PropertyGroup>
   <RuntimeIdentifier>win7-x64</RuntimeIdentifier>
   <BaseNuGetRuntimeIdentifier>win7-x64</BaseNuGetRuntimeIdentifier>
</PropertyGroup>
```
to win7-x86 if required.
- fix exception in https client when setting the Timeout
- fix travis build script for linux. kestrel server on ubuntu doesn't respond on ipv6Any ipaddress.
- fix a timing problem in the travis script.
---
 .../Opc.Ua.SampleClient.Config.xml            | 13 ++--
 .../Opc.Ua.SampleClient.Endpoints.xml         | 60 +++++++++++++++++++
 .../Client.Net4/UA Sample Client.csproj       | 47 ++-------------
 .../Opc.Ua.SampleServer.Config.xml            | 19 +++---
 .../Server.Net4/UA Sample Server.csproj       |  4 ++
 .../Certificates/CertificateValidator.cs      |  2 +-
 .../Opc.Ua.Core/Stack/Https/HttpsListener.cs  |  7 +--
 .../Stack/Https/HttpsTransportChannel.cs      | 57 ++++++++++--------
 Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs  | 22 +++----
 testclientserver.sh                           | 47 ++++++++++-----
 10 files changed, 163 insertions(+), 115 deletions(-)

diff --git a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml
index d623f38582..1c32ac7307 100644
--- a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml
+++ b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Config.xml
@@ -137,6 +137,7 @@
          http://localhost:61211/UA/SampleClient/Basic256 -->
     <BaseAddresses>
       <ua:String>opc.tcp://localhost:61210/UA/SampleClient</ua:String>
+      <ua:String>https://localhost:61212/UA/SampleClient</ua:String>
     </BaseAddresses>
 
     <!-- 
@@ -167,7 +168,7 @@
     <SecurityPolicies>
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
@@ -182,17 +183,17 @@
         <SecurityMode>Sign_2</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
       </ServerSecurityPolicy>
-      <ServerSecurityPolicy>
-        <SecurityMode>SignAndEncrypt_3</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
-      </ServerSecurityPolicy>      
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
       </ServerSecurityPolicy>
     </SecurityPolicies>
 
diff --git a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Endpoints.xml b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Endpoints.xml
index 7b0aa60dde..12180898c5 100644
--- a/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Endpoints.xml
+++ b/SampleApplications/Samples/Client.Net4/Opc.Ua.SampleClient.Endpoints.xml
@@ -34,6 +34,36 @@
       <ua:UpdateBeforeConnect>true</ua:UpdateBeforeConnect>
       <ua:SelectedUserTokenPolicy>0</ua:SelectedUserTokenPolicy>
     </ua:ConfiguredEndpoint>
+    
+    <!-- 
+      Self, acting as a server endpoint:
+        https://localhost:61212/UA/SampleClient // -->
+    <ua:ConfiguredEndpoint>
+      <ua:Endpoint>
+        <EndpointUrl>https://localhost:61212/UA/SampleClient</EndpointUrl>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <UserIdentityTokens>
+          <UserTokenPolicy>
+            <TokenType>Anonymous_0</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <TokenType>UserName_1</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <TokenType>Certificate_2</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <PolicyId xsi:nil="true" />
+            <TokenType>IssuedToken_3</TokenType>
+            <IssuedTokenType>urn:oasis:names:tc:SAML:1.0:assertion:Assertion</IssuedTokenType>
+          </UserTokenPolicy>
+        </UserIdentityTokens>
+        <TransportProfileUri>http://opcfoundation.org/UA/profiles/transport/wsxmlorbinary</TransportProfileUri>
+      </ua:Endpoint>
+      <ua:UpdateBeforeConnect>true</ua:UpdateBeforeConnect>
+      <ua:SelectedUserTokenPolicy>0</ua:SelectedUserTokenPolicy>
+    </ua:ConfiguredEndpoint>
 
     <!-- 
       Sample server, opc.tcp endpoint:
@@ -64,6 +94,36 @@
       <ua:UpdateBeforeConnect>true</ua:UpdateBeforeConnect>
       <ua:SelectedUserTokenPolicy>0</ua:SelectedUserTokenPolicy>
     </ua:ConfiguredEndpoint>
+    
+    <!-- 
+      Sample server, opc.tcp endpoint:
+        https://localhost:51212/UA/SampleServer // -->
+    <ua:ConfiguredEndpoint>
+      <ua:Endpoint>
+        <EndpointUrl>https://localhost:51212/UA/SampleServer</EndpointUrl>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+        <UserIdentityTokens>
+          <UserTokenPolicy>
+            <TokenType>Anonymous_0</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <TokenType>UserName_1</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <TokenType>Certificate_2</TokenType>
+          </UserTokenPolicy>
+          <UserTokenPolicy>
+            <PolicyId xsi:nil="true" />
+            <TokenType>IssuedToken_3</TokenType>
+            <IssuedTokenType>urn:oasis:names:tc:SAML:1.0:assertion:Assertion</IssuedTokenType>
+          </UserTokenPolicy>
+        </UserIdentityTokens>
+        <TransportProfileUri>http://opcfoundation.org/UA/profiles/transport/wsxmlorbinary</TransportProfileUri>
+      </ua:Endpoint>
+      <ua:UpdateBeforeConnect>true</ua:UpdateBeforeConnect>
+      <ua:SelectedUserTokenPolicy>0</ua:SelectedUserTokenPolicy>
+    </ua:ConfiguredEndpoint>
 
     <!-- 
       Reference server, opc.tcp endpoint:
diff --git a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj
index 8d2a62fa26..ae25a4efa4 100644
--- a/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj	
+++ b/SampleApplications/Samples/Client.Net4/UA Sample Client.csproj	
@@ -19,27 +19,12 @@
     <OldToolsVersion>3.5</OldToolsVersion>
     <UpgradeBackupLocation>
     </UpgradeBackupLocation>
-    <IsWebBootstrapper>true</IsWebBootstrapper>
     <TargetFrameworkVersion>v4.6</TargetFrameworkVersion>
     <SignAssembly>false</SignAssembly>
     <AssemblyOriginatorKeyFile>
     </AssemblyOriginatorKeyFile>
     <ApplicationManifest>app.manifest</ApplicationManifest>
     <TargetFrameworkProfile />
-    <PublishUrl>http://localhost/Opc.Ua.SampleClient/</PublishUrl>
-    <Install>true</Install>
-    <InstallFrom>Web</InstallFrom>
-    <UpdateEnabled>true</UpdateEnabled>
-    <UpdateMode>Foreground</UpdateMode>
-    <UpdateInterval>7</UpdateInterval>
-    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
-    <UpdatePeriodically>false</UpdatePeriodically>
-    <UpdateRequired>false</UpdateRequired>
-    <MapFileExtensions>true</MapFileExtensions>
-    <ApplicationRevision>0</ApplicationRevision>
-    <ApplicationVersion>1.0.0.%2a</ApplicationVersion>
-    <UseApplicationTrust>false</UseApplicationTrust>
-    <BootstrapperEnabled>true</BootstrapperEnabled>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -109,6 +94,7 @@
     </EmbeddedResource>
     <Content Include="Opc.Ua.SampleClient.Config.xml">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
+      <SubType>Designer</SubType>
     </Content>
     <Content Include="Opc.Ua.SampleClient.Endpoints.xml">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
@@ -161,33 +147,6 @@
       <Name>Opc.Ua.Sample</Name>
     </ProjectReference>
   </ItemGroup>
-  <ItemGroup>
-    <BootstrapperPackage Include="Microsoft.Net.Client.3.5">
-      <Visible>False</Visible>
-      <ProductName>.NET Framework Client Profile</ProductName>
-      <Install>false</Install>
-    </BootstrapperPackage>
-    <BootstrapperPackage Include="Microsoft.Net.Framework.2.0">
-      <Visible>False</Visible>
-      <ProductName>.NET Framework 2.0 %28x86%29</ProductName>
-      <Install>true</Install>
-    </BootstrapperPackage>
-    <BootstrapperPackage Include="Microsoft.Net.Framework.3.0">
-      <Visible>False</Visible>
-      <ProductName>.NET Framework 3.0 %28x86%29</ProductName>
-      <Install>false</Install>
-    </BootstrapperPackage>
-    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5">
-      <Visible>False</Visible>
-      <ProductName>.NET Framework 3.5</ProductName>
-      <Install>false</Install>
-    </BootstrapperPackage>
-    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
-      <Visible>False</Visible>
-      <ProductName>.NET Framework 3.5 SP1</ProductName>
-      <Install>false</Install>
-    </BootstrapperPackage>
-  </ItemGroup>
   <ItemGroup>
     <Content Include="app.manifest" />
   </ItemGroup>
@@ -196,6 +155,10 @@
       <Version>4.3.3</Version>
     </PackageReference>
   </ItemGroup>
+  <PropertyGroup>
+    <RuntimeIdentifier>win7-x64</RuntimeIdentifier>
+    <BaseNuGetRuntimeIdentifier>win7-x64</BaseNuGetRuntimeIdentifier>
+  </PropertyGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
diff --git a/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml b/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml
index 3e38beec2c..2b507fbc7a 100644
--- a/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml
+++ b/SampleApplications/Samples/Server.Net4/Opc.Ua.SampleServer.Config.xml
@@ -55,6 +55,7 @@
   <ServerConfiguration>
     <BaseAddresses>
       <ua:String>opc.tcp://localhost:51210/UA/SampleServer</ua:String>
+      <ua:String>https://localhost:51212/UA/SampleServer</ua:String>
     </BaseAddresses>
 
     <!-- 
@@ -77,33 +78,33 @@
     <SecurityPolicies>
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>Sign_2</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
       </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
+      </ServerSecurityPolicy>
       <!--Removing no security option from the configuration as this is a security risk
         <ServerSecurityPolicy>
         <SecurityMode>None_1</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</SecurityPolicyUri>
       </ServerSecurityPolicy>-->
       <ServerSecurityPolicy>
-        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
       </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
       </ServerSecurityPolicy>
-      <ServerSecurityPolicy>
-        <SecurityMode>Sign_2</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
-      </ServerSecurityPolicy>
-      <ServerSecurityPolicy>
-        <SecurityMode>SignAndEncrypt_3</SecurityMode>
-        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
-      </ServerSecurityPolicy>
     </SecurityPolicies>
 
     <MinRequestThreadCount>5</MinRequestThreadCount>
diff --git a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj
index 4d27f6f1a7..506952cbb1 100644
--- a/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj	
+++ b/SampleApplications/Samples/Server.Net4/UA Sample Server.csproj	
@@ -153,6 +153,10 @@
   <ItemGroup>
     <None Include="app.manifest" />
   </ItemGroup>
+  <PropertyGroup>
+    <RuntimeIdentifier>win7-x64</RuntimeIdentifier>
+    <BaseNuGetRuntimeIdentifier>win7-x64</BaseNuGetRuntimeIdentifier>
+  </PropertyGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
diff --git a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs
index ff37ad66c8..9ae4ba9f0a 100644
--- a/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs
+++ b/Stack/Opc.Ua.Core/Security/Certificates/CertificateValidator.cs
@@ -236,7 +236,7 @@ namespace Opc.Ua
                     InternalValidate(chain).Wait();
 
                     // add to list of validated certificates.
-                    m_validatedCertificates[certificate.Thumbprint] = certificate;
+                    m_validatedCertificates[certificate.Thumbprint] = new X509Certificate2(certificate.RawData);
                 }
             }
             catch (AggregateException ae)
diff --git a/Stack/Opc.Ua.Core/Stack/Https/HttpsListener.cs b/Stack/Opc.Ua.Core/Stack/Https/HttpsListener.cs
index 48b9842fb8..ec1d74d8f8 100644
--- a/Stack/Opc.Ua.Core/Stack/Https/HttpsListener.cs
+++ b/Stack/Opc.Ua.Core/Stack/Https/HttpsListener.cs
@@ -187,12 +187,7 @@ namespace Opc.Ua.Bindings
             httpsOptions.ServerCertificate = m_serverCert;
             httpsOptions.SslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12;
             m_host.UseKestrel(options =>
-            {
-                options.Listen(IPAddress.IPv6Any, m_uri.Port, listenOptions =>
-                {
-                    listenOptions.NoDelay = true;
-                    listenOptions.UseHttps(httpsOptions);
-                });
+            {              
                 options.Listen(IPAddress.Any, m_uri.Port, listenOptions =>
                 {
                     listenOptions.NoDelay = true;
diff --git a/Stack/Opc.Ua.Core/Stack/Https/HttpsTransportChannel.cs b/Stack/Opc.Ua.Core/Stack/Https/HttpsTransportChannel.cs
index faaf628ead..4dccb8aefe 100644
--- a/Stack/Opc.Ua.Core/Stack/Https/HttpsTransportChannel.cs
+++ b/Stack/Opc.Ua.Core/Stack/Https/HttpsTransportChannel.cs
@@ -25,7 +25,7 @@ namespace Opc.Ua.Bindings
     public class HttpsTransportChannel : ITransportChannel
     {
         public void Dispose()
-        {   
+        {
         }
 
         public TransportChannelFeatures SupportedFeatures
@@ -50,7 +50,7 @@ namespace Opc.Ua.Bindings
 
         public int OperationTimeout
         {
-            get { return m_operationTimeout;  }
+            get { return m_operationTimeout; }
             set { m_operationTimeout = value; }
         }
 
@@ -60,7 +60,7 @@ namespace Opc.Ua.Bindings
         {
             SaveSettings(url, settings);
         }
-        
+
         public void Open()
         {
             try
@@ -79,7 +79,17 @@ namespace Opc.Ua.Bindings
                         handler.ServerCertificateCustomValidationCallback =
                             (httpRequestMessage, cert, chain, policyErrors) =>
                             {
-                                return true;
+                                try
+                                {
+                                    m_quotas.CertificateValidator?.Validate(cert);
+                                    return true;
+                                }
+                                catch (Exception ex)
+                                {
+                                    Utils.Trace("HTTPS: Failed to validate server cert: " + cert.Subject);
+                                    Utils.Trace("HTTPS: Exception:" + ex.Message);
+                                }
+                                return false;
                             };
                     }
                     catch (PlatformNotSupportedException)
@@ -135,23 +145,22 @@ namespace Opc.Ua.Bindings
                 content.Headers.ContentType = new MediaTypeHeaderValue("application/octet-stream");
 
                 AsyncResult result = new AsyncResult(callback, callbackData, m_operationTimeout, request, null);
-                m_client.Timeout = TimeSpan.FromMilliseconds(m_operationTimeout);
-                Task.Run( async () =>
-                {
-                    try
-                    {
-                        response = await m_client.PostAsync(m_url, content);
-                        response.EnsureSuccessStatusCode();
-                    }
-                    catch (Exception ex)
-                    {
-                        Utils.Trace("Exception sending HTTPS request: " + ex.Message);
-                        result.Exception = ex;
-                        response = null;
-                    }
-                    result.Response = response;
-                    result.OperationCompleted();
-                });
+                Task.Run(async () =>
+               {
+                   try
+                   {
+                       response = await m_client.PostAsync(m_url, content);
+                       response.EnsureSuccessStatusCode();
+                   }
+                   catch (Exception ex)
+                   {
+                       Utils.Trace("Exception sending HTTPS request: " + ex.Message);
+                       result.Exception = ex;
+                       response = null;
+                   }
+                   result.Response = response;
+                   result.OperationCompleted();
+               });
 
                 return result;
             }
@@ -214,7 +223,7 @@ namespace Opc.Ua.Bindings
         {
             throw new NotImplementedException();
         }
-        
+
         public IAsyncResult BeginClose(AsyncCallback callback, object callbackData)
         {
             throw new NotImplementedException();
@@ -230,10 +239,10 @@ namespace Opc.Ua.Bindings
             IAsyncResult result = BeginSendRequest(request, null, null);
             return EndSendRequest(result);
         }
-        
+
         private void SaveSettings(Uri url, TransportChannelSettings settings)
         {
-            m_url = new Uri(Utils.ReplaceLocalhost(url.ToString()));
+            m_url = new Uri(url.ToString());
 
             m_settings = settings;
             m_operationTimeout = settings.Configuration.OperationTimeout;
diff --git a/Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs b/Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs
index bc2619ece9..5f4631c068 100644
--- a/Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs
+++ b/Stack/Opc.Ua.Core/Stack/Server/ServerBase.cs
@@ -828,25 +828,25 @@ namespace Opc.Ua
 
                 if (uri.Scheme == Utils.UriSchemeHttps)
                 {
-                    // can only support one policy with HTTPS so pick the best one.
+                    // Can only support one policy with HTTPS so pick the 
+                    // first secure policy with sign and encrypt in the list 
                     ServerSecurityPolicy bestPolicy = null;
-                    byte bestLevel = 0;
                     foreach (ServerSecurityPolicy policy in securityPolicies)
                     {
-                        if (bestPolicy == null)
+                        if (policy.SecurityMode != MessageSecurityMode.SignAndEncrypt)
                         {
-                            bestPolicy = policy;
                             continue;
                         }
 
-                        byte securityLevel = ServerSecurityPolicy.CalculateSecurityLevel(policy.SecurityMode, policy.SecurityPolicyUri);
-                        if (bestLevel < securityLevel)
-                        {
-                            bestPolicy = policy;
-                            bestLevel = securityLevel;
-                        }
+                        bestPolicy = policy;
+                        break;
                     }
-                
+
+                    if (bestPolicy == null)
+                    {
+                        throw new ServiceResultException("HTTPS transport requires policy with sign and encrypt.");
+                    }
+
                     EndpointDescription description = new EndpointDescription();
 
                     description.EndpointUrl = uri.ToString();
diff --git a/testclientserver.sh b/testclientserver.sh
index a369a633c6..74b9babc49 100755
--- a/testclientserver.sh
+++ b/testclientserver.sh
@@ -9,18 +9,29 @@ cd SampleApplications/Samples/NetCoreConsoleServer
 echo build server
 rm -r obj
 dotnet build NetCoreConsoleServer.csproj
-echo start server
-dotnet run --no-restore --no-build --project NetCoreConsoleServer.csproj -t 60 -a &
-serverpid="$!"
-cd $workdir
-
-cd SampleApplications/Samples/NetCoreConsoleClient
+cd ../NetCoreConsoleClient
 echo build client
 rm -r obj
 dotnet build NetCoreConsoleClient.csproj
-echo start client
-dotnet run --no-restore --no-build --project NetCoreConsoleClient.csproj -t 10 -a &
+cd $workdir
+
+cd SampleApplications/Samples/NetCoreConsoleServer
+echo start server
+touch ./server.log
+dotnet run --no-restore --no-build --project NetCoreConsoleServer.csproj -t 60 -a >./server.log &
+serverpid="$!"
+echo wait for server started
+grep -m 1 "start" <(tail -f ./server.log --pid=$serverpid)
+tail -f ./server.log --pid=$serverpid &
+cd $workdir
+
+cd SampleApplications/Samples/NetCoreConsoleClient
+echo start client for tcp connection
+dotnet run --no-restore --no-build --project NetCoreConsoleClient.csproj -t 20 -a &
 clientpid="$!"
+echo start client for https connection
+dotnet run --no-restore --no-build --project NetCoreConsoleClient.csproj -t 20 -a https://localhost:51212 &
+httpsclientpid="$!"
 cd $workdir
 
 echo wait for opc.tcp client
@@ -33,21 +44,25 @@ else
 fi
 
 cd SampleApplications/Samples/NetCoreConsoleClient
-echo start client for https connection
-dotnet run --no-restore --no-build --project NetCoreConsoleClient.csproj -t 10 -a https://localhost:51212 &
-clientpid="$!"
 cd $workdir
 
-echo wait for opc.tcp client
-wait $clientpid
+echo wait for https client
+wait $httpsclientpid
 if [ $? -eq 0 ]; then
 	echo "SUCCESS - Client test passed"
 else
 	testresulthttps=$?
-	echo "WARN - Client test failed with a status of $testresulthttps"
-	echo "WARN - Client may require to use trusted TLS server cert to pass this test"
+	echo "FAILED - Client test failed with a status of $testresulthttps"
+	echo "FAILED - Client may require to use trusted TLS server cert to pass this test"
+	if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then 
+		testresulthttps=0 
+		echo "IGNORED - test requires trusted TLS cert on OSX"
+	fi
 fi
 
+echo send Ctrl-C to server
+kill -s SIGINT $serverpid
+
 echo wait for server
 wait $serverpid
 serverresult=$?
@@ -60,7 +75,7 @@ else
 fi
 
 echo "Test results: Client:$testresult Server:$serverresult ClientHttps:$testresulthttps"
-exit $((testresult + serverresult))
+exit $((testresult + serverresult + testresulthttps))