Merge remote-tracking branch 'origin/master' into codex/opcua-sdk-2

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/HistorianGatewayClientAdapter.cs

@@ -57,23 +57,15 @@ public sealed class HistorianGatewayClientAdapter : IHistorianGatewayClient, IDi
                 $"ServerHistorian:Endpoint must be an absolute http(s) URI (e.g. https://host:5222); got '{options.Endpoint}'.");
         }
 
-        // TLS-only options must stay at their defaults on a plaintext h2c connection: the client rejects
-        // each of them outright when UseTls=false ("<name> is a TLS-only option and requires
-        // UseTls=true"). Forwarding them unconditionally made h2c UNREACHABLE — AllowUntrustedServer-
-        // Certificate defaults to false, so RequireCertificateValidation was always sent as true and
-        // every http:// deployment crashed at startup, even though the scheme is documented as the
-        // supported way to select h2c. There is no certificate to have a posture about here.
+        // Certificate settings apply only to TLS. The client rejects an explicit opt-out or a
+        // CA path on h2c, where there is no certificate to validate.
         var clientOptions = new HistorianGatewayClientOptions
         {
             Endpoint = endpointUri,
             ApiKey = options.ApiKey,
             UseTls = options.UseTls,
             CaCertificatePath = options.UseTls ? options.CaCertificatePath : null,
-            // INVERTED mapping (TLS only): ServerHistorianOptions.AllowUntrustedServerCertificate
-            // (opt-in to accept a self-signed cert) is the negation of the client's
-            // RequireCertificateValidation. Allowing an untrusted cert == not requiring validation; a
-            // pinned CaCertificatePath always verifies.
-            RequireCertificateValidation = options.UseTls && !options.AllowUntrustedServerCertificate,
+            AllowUntrustedServerCertificate = options.UseTls && options.AllowUntrustedServerCertificate,
             DefaultCallTimeout = options.CallTimeout,
             LoggerFactory = loggerFactory,
         };