[Server] Fix #3896: send full certificate chain when CA is in the issuer store (1.5.x) by marcschier · Pull Request #3898 · OPCFoundation/UA-.NETStandard

marcschier · 2026-06-20T05:39:16Z

Description

Fixes #3896 on the 1.5.x maintenance line. A server configured with SecurityConfiguration.SendCertificateChain = true, whose application instance certificate is issued by a CA placed in the issuer store (TrustedIssuerCertificates), sent only the leaf certificate instead of the full chain. Clients that rely on receiving the chain then failed to connect.

Root cause

Introduced in 1.5.375 by commit f001eabcc ("Add support for ECC profiles", #2398), which moved chain loading into CertificateTypesProvider.LoadCertificateChainAsync:

if (await m_certificateValidator.GetIssuersAsync(certificate, issuers).ConfigureAwait(false))
{
    for (int i = 0; i < issuers.Count; i++)
    {
        certificateChain.Add(issuers[i].Certificate);
    }
}

GetIssuersAsync returns isTrusted — true only when the issuer is found in the trusted store — but populates the issuers out-list regardless (trusted → issuer → untrusted). When the CA lives in the issuer store (the spec-recommended setup), the call returns false, so the already-resolved issuers were discarded and the chain stayed leaf-only.

This is a regression from 1.5.374, where the issuers were appended unconditionally.

Fix

Append the resolved issuers unconditionally; the boolean trust result is intentionally ignored — a server must send its chain even when the issuing CA is in the issuer store rather than the trusted store.

_ = await m_certificateValidator.GetIssuersAsync(certificate, issuers).ConfigureAwait(false);
for (int i = 0; i < issuers.Count; i++)
{
    certificateChain.Add(issuers[i].Certificate);
}

The companion fix for the 2.0 line (master) is in a separate PR.

Tests

New CertificateTypesProviderTests:

LoadCertificateChainResolvesIssuerFromIssuerStoreAsync: the CA is placed in the issuer store only — not the trusted store — and the resolved chain is asserted to be leaf + CA (and the raw blob leaf || CA byte-for-byte). Confirmed this test fails with the original gate and passes with the fix.
LoadCertificateChainFallsBackToLeafWhenIssuerMissingAsync: when the CA is in neither store, the chain is leaf-only without throwing.

Verified locally on net48 and net10.0 (new tests + existing VerifyIssuerChain* validator tests pass). Build is clean.

Related Issues

Fixes #3896.

Checklist

I have signed the CLA and read the CONTRIBUTING doc.
I have added tests that prove my fix is effective or that my feature works and increased code coverage.
I have added all necessary documentation (no public API change; behavioural fix only).
I have verified that my changes do not introduce (new) build or analyzer warnings.
I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. (Ran the certificate suites on net48 + net10.0; full-solution run pending CI.)
I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings.
I have addressed all PR feedback received.

…uer store CertificateTypesProvider.LoadCertificateChainAsync only appended resolved issuers to the chain when GetIssuersAsync returned true. That return value is isTrusted (true only when the issuer is in the trusted store), so a CA placed in the issuer store - the spec-recommended setup - was resolved but then discarded, and SendCertificateChain=true sent the leaf certificate only. Append the resolved issuers unconditionally (restoring the 1.5.374 behaviour); the boolean trust result is intentionally ignored. Adds CertificateTypesProviderTests covering the issuer-store chain and the leaf-only fallback when no issuer is resolvable.

CLAassistant · 2026-06-20T05:39:22Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

agent seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

marcschier · 2026-06-20T05:39:31Z

Companion 2.0 (master) fix: #3897.

codecov · 2026-06-20T05:42:40Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.16%. Comparing base (00519fa) to head (d94c356).

Additional details and impacted files

@@              Coverage Diff              @@
##           master378    #3898      +/-   ##
=============================================
+ Coverage      60.11%   60.16%   +0.04%     
=============================================
  Files            378      378              
  Lines          79060    79060              
  Branches       13837    13836       -1     
=============================================
+ Hits           47526    47564      +38     
+ Misses         27105    27074      -31     
+ Partials        4429     4422       -7

Files with missing lines	Coverage Δ
.../Security/Certificates/CertificateTypesProvider.cs	`72.97% <100.00%> (+4.05%)`	⬆️

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

marcschier mentioned this pull request Jun 20, 2026

[Server] Fix #3896: send full certificate chain when CA is in the issuer store #3897

Merged

7 tasks

marcschier added the 1.5.378 Only affects 1.5.378 (pre 2.0) label Jun 20, 2026

romanett approved these changes Jun 21, 2026

View reviewed changes

mrsuciu merged commit 35708e8 into master378 Jun 21, 2026
108 of 110 checks passed

marcschier deleted the sendcertchain378 branch July 8, 2026 14:55

dependabot Bot mentioned this pull request Jul 22, 2026

Bump the opcfoundation group with 11 updates OPCFoundation/UA-.NETStandard-Samples#710

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Server] Fix #3896: send full certificate chain when CA is in the issuer store (1.5.x)#3898

[Server] Fix #3896: send full certificate chain when CA is in the issuer store (1.5.x)#3898
mrsuciu merged 1 commit into
master378from
sendcertchain378

marcschier commented Jun 20, 2026

Uh oh!

CLAassistant commented Jun 20, 2026

Uh oh!

marcschier commented Jun 20, 2026

Uh oh!

codecov Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

marcschier commented Jun 20, 2026

Description

Root cause

Fix

Tests

Related Issues

Checklist

Uh oh!

CLAassistant commented Jun 20, 2026

Uh oh!

marcschier commented Jun 20, 2026

Uh oh!

codecov Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov Bot commented Jun 20, 2026 •

edited

Loading