Hi,

Multiple things to answer.

Cert chains:
Historically speaking, anything else than self-signed certs have been very rare. In some cases CA certs have been used, but it has been more like one per factory floor, and this CA cert (public key) has then just been copied on all installations. CA certs etc. are slowly becoming more used and the GDS (GlobalDiscoveryServer) will make this easier once we support that. Anyway, at the moment it is not possible to obtain the cert chain. The SDK like wont crash if it gets one, but it will discard the rest of the certs. Thus at the moment it is expected to copy the CA cert public key manually. But this is something we’ll need to improve, just that there has basically not been a need yet.

“It also does not give me a hostname of the client connecting to me”:
In OPC UA only the client side will check the hostname of the server’s cert. Though SDK doesn’t do that yet automatically (might do in some future major version): https://forum.prosysopc.com/forum/opc-ua-java-sdk/using-wildcards-in-subject-alternative-name-for-application-certificate/, but you can check that manually, see sampleconsoleclient MyCertificateValidationListener where CertificateUtils.getDnsOfCertificate(certificate) and CertificateUtils.getIpOfCertificate(certificate) are used. Note that the code itself doesn’t validate it per each connection, just when the cert is to be first accepted, but you could modify that.