Hello, and thank you for your quick response. It is unfortunate this is not supported by the sdk out of the box. We will have to discuss with our customer how important this is for them.

We used to use the constructor, but saw no way of adding an intermediate certificate, so we explored the loadOrCreate-methods.

My knowledge of certificates and standards leave a lot to be desired, so I’m not exactly sure how the different representations of certificates and chains fit together.
I will try to explain the possible solution the way I see it, and welcome any feedback on whether I understood your proposal.

Today the Cert-class can read a .der-file (using CertificateUtils) and create an internal representation for the first certificate in the file.
When clients connect to the server, the server calls the getEncoded()-method and sends the resulting byte-array to the client.

To make the server send a certificate chain, we would have to extend the Cert-class and override the getEncoded()-method to send a byte-array representing the entire certificate chain instead.
Our new CertificateChain-class would probably take in a number of File-objects that together represents the entire chain (or as much of it as we need).
Our override of getEncoded() would need to combine the byte-arrays of all certificates in the chain in some way.
We could potentially just let our class contain a list of Cert- or X509Certificate-objects and let our overridden methods use the existing methods on those in some way.

I think the theory sounds quite simple, but there are some things that are still unclear to me.
Would a combined byte-representation of a chain of certificates just be the byte-representation of each individual certificate concatenated?
Would we need to indicate that the byte array consists of multiple certificates instead of just one, or is that implicit?
The cert-class also contains a Thumbprint. Will this be affected by concatenated multiple certificates? Is this also something I would need to override?

Concatenating all the certificates seems to work. The client now reports seeing the entire certificate chain. I am encountering another issue when trying to connect from the client, however. I get a ‘BadApplicationSignatureInvalid’. I’m not quite sure where the error occurs, It seems the client asks the server to end the session, so perhaps we need to do something more:

2024-02-28 09:54:31,008 [OPC-UA-Stack-Blocking-Work-Executor-23] DEBUG c.p.u.s.t.t.n.OpcTcpServerConnection – handleSecureMessage: secureChannelId=2msg=ActivateSessionRequest
2024-02-28 09:54:31,036 [OPC-UA-Stack-Blocking-Work-Executor-27] DEBUG c.p.u.s.t.t.n.OpcTcpServerConnection – handleSecureMessage: secureChannelId=2msg=CloseSessionRequest

I think I will have to try debugging the server-code to figure out exactly what happens. The client I’m using is UAExpert, which I understand is the reference client implementation.