mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-29 07:07:24 +08:00
Marc SchierandCopilot
d9c77cd23f
# Description This draft splits the certificate-related changes from #4021, sourced only from commits `31350bf3b` and `1aed3b7ed`. - Enforces OPC UA HTTPS trust-list semantics for every presented client certificate, even when platform TLS/OS trust reports no policy errors. This prevents OS trust from bypassing the configured UA HTTPS trust list. - Passes the full TLS-supplied certificate chain to the UA validator and selects `TrustListIdentifier.Https`, preserving intermediates for application-level chain validation. - Uses the signature generator's exact `AlgorithmIdentifier` in both the CRL `TBSCertList` and outer `CertificateList`. RFC 5280 §5.1.1 requires these inner and outer identifiers to match; independently encoding the inner value could disagree with the actual signature algorithm. ## Validation - HTTPS certificate-validation tests: net10.0 (6 passed), net48 (6 passed). - CRL tests: net10.0 (95 passed), net48 (95 passed). - `Opc.Ua.Bindings.Https` and `Opc.Ua.Security.Certificates`: netstandard2.1 builds succeeded with 0 warnings and 0 errors. - `git diff --check` passed. ## Related Issues - Split from #4021. ## Checklist _Only verified claims are checked._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>