romanett 21e04bdba5 Make Bad_CertificateChainIncomplete unsuppressible; add UpdateCertificate renewal regression tests (#4683) ...

# Description

Follow-up to the master378 fix in #4678 (CTT: application certificate
renewal must use the configured trust stores). Master already ignores
the supplied `issuerCertificates` for the default application group (OPC
10000-12 §7.10.5), but it had no regression tests for CA-signed
renewals. While adding them I found a real gap:

**The validator treated `Bad_CertificateChainIncomplete` as
suppressible.** OPC 10000-4 Table 100 (Build Certificate Chain) says:
"An error during the chain creation may not be suppressed." §6.1.3 adds:
"Processing fails with Bad_SecurityChecksFailed if an element in the
chain cannot be found." UpdateCertificate for the application group
accepts every *suppressible* error (as §7.10.5 requires). As a result it
accepted a renewal signed by a CA that is **not** in the TrustList and
was only passed in the ignored issuer list, which is exactly what
§7.10.5 rules out.

## Changes
- `CertificateValidationCore`: remove `BadCertificateChainIncomplete`
from the suppressible status codes. An accept callback (`AcceptError`)
is no longer asked about it.
- `TrustList`: remove the local workaround that filtered out this error;
plain "accept suppressible errors" is now enough.
- Docs (`Certificates.md`, `CertificateManager.md`): drop it from the
suppressible list, and fix a sample that suppressed it.

## Tests
- `ConfigurationNodeManagerPushTests`:
- A CA-signed renewal with the CA installed succeeds with a missing,
empty, unrelated or malformed issuer list, and the trust stores stay
unchanged.
- A renewal whose CA is only supplied as an issuer is rejected with
`BadCertificateChainIncomplete`; stores and the current certificate are
untouched.
- End to end on an isolated server: a CA-signed renewal with no issuer
list is committed through ApplyChanges.
- `ConfigurationNodeManagerPushValidationTests`: the group TrustList
validator accepts a CA from the trusted or issuer store and rejects an
uninstalled CA.
- `CertificateValidationCoreTests` / `CertificateValidatorTest`:
- An incomplete chain is unsuppressible and never reaches the callback.
- A leaf trusted directly **stays valid when the peer supplies its CA**
(§6.1.3: chain certificates "may be provided with the application
Certificate").
- One existing test attached its approver only after validating, so it
never exercised suppression; it now validates with the approver
attached.
- Tests that only passed because of the bug
(`PushCertificateRequestRegressionTests`, the regenerated-key helper and
the rollback test) now install the signing CA in the TrustList first.

The two new rejection tests fail on master and pass with this change.

## Reviewer notes / behavior change
This was suppressible in 1.5.x as well. Application code whose accept
handler approved a CA-signed peer certificate without its CA (CA neither
installed nor sent by the peer) will now get a rejection. Without a
handler such certificates were already rejected, and the stack's own
handlers (`ApplicationInstance`, push validation) never accepted this
error. Worth a release note.

Local runs (net10.0), all passing:

| Suite | Passed | Failed |
|---|---|---|
| Server.Tests | 8310 | 0 |
| Core.Tests (security/transport filter) | 2039 | 0 |
| Security.Certificates.Tests | 358 | 0 |
| Core.Security.Tests | 558 | 0 |
| Client.Tests | 2761 | 0 |
| Gds.Tests (PushTest and TrustList tests) | 345 | 0 |

The net48 builds of Server.Tests and Core.Tests also succeed.

## Related Issues

- Related to #4678 (master378 counterpart)

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [ ] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 18:14:17 +02:00

..

2.0.x

Make Bad_CertificateChainIncomplete unsuppressible; add UpdateCertificate renewal regression tests (#4683)

2026-10-06 18:14:17 +02:00