## Failure
MCP auto-accept mutated the shared application certificate manager and
accepted
every certificate error, so one permissive connection could affect
concurrent or
later strict sessions. The durable-subscription sample also serialized
complete
user identity tokens, including user-name passwords and issued bearer
tokens.
## Fix
- Isolate auto-accept certificate managers/configurations per connection
and keep
their lifetime with the managed session.
- Auto-accept only `BadCertificateUntrusted`; retain strict validation
for all
other certificate errors and shared sessions.
- Version the durable store and reject the previous unsafe format.
- Remove user-name passwords before persistence and reject issued-token
subscriptions rather than storing bearer credentials.
- Add focused tools tests plus solution, project, and
durable-subscription docs.
## Reference
- OPC 10000-4 Session identity-token and application-certificate
security.
- Split from #4021.
## Tests
- `Opc.Ua.Tools.Tests` Release: 7 passed on net10.0; 4 passed on net48.
- `Quickstarts.Servers` Release builds passed on net10.0 and net48 with
zero warnings/errors.
- `Opc.Ua.Mcp` Release net10.0 build passed with zero warnings/errors.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Marc Schier