diff --git a/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs b/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs
index ba33fd53..2722d350 100644
--- a/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs
+++ b/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs
@@ -23,7 +23,7 @@ internal sealed class DefaultApplicationConfigurationFactory : IApplicationConfi
             ? ClientStoragePaths.GetPkiPath()
             : settings.CertificateStorePath;
 
-        var config = new ApplicationConfiguration
+        var config = new ApplicationConfiguration(ClientTelemetry.Context)
         {
             ApplicationName = "OtOpcUaClient",
             ApplicationUri = "urn:localhost:OtOpcUaClient",
@@ -33,7 +33,8 @@ internal sealed class DefaultApplicationConfigurationFactory : IApplicationConfi
                 ApplicationCertificate = new CertificateIdentifier
                 {
                     StoreType = CertificateStoreType.Directory,
-                    StorePath = Path.Combine(storePath, "own")
+                    StorePath = Path.Combine(storePath, "own"),
+                    SubjectName = "CN=OtOpcUaClient"
                 },
                 TrustedIssuerCertificates = new CertificateTrustList
                 {
diff --git a/tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Adapters/DefaultApplicationConfigurationFactoryTests.cs b/tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Adapters/DefaultApplicationConfigurationFactoryTests.cs
new file mode 100644
index 00000000..5b70df63
--- /dev/null
+++ b/tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Adapters/DefaultApplicationConfigurationFactoryTests.cs
@@ -0,0 +1,39 @@
+using Opc.Ua;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Adapters;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
+
+namespace ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.Adapters;
+
+/// <summary>Uses the real configuration factory so fake sessions cannot conceal SDK initialization failures.</summary>
+public sealed class DefaultApplicationConfigurationFactoryTests
+{
+    [Theory]
+    [InlineData(SecurityMode.None)]
+    [InlineData(SecurityMode.SignAndEncrypt)]
+    public async Task Real_configuration_initializes_its_certificate_manager(SecurityMode mode)
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"otopcua-real-config-{Guid.NewGuid():N}");
+        ApplicationConfiguration? config = null;
+        try
+        {
+            config = await new DefaultApplicationConfigurationFactory().CreateAsync(new ConnectionSettings
+            {
+                EndpointUrl = "opc.tcp://localhost:4840",
+                CertificateStorePath = root,
+                SecurityMode = mode,
+                AutoAcceptCertificates = false,
+            }, TestContext.Current.CancellationToken);
+            config.CertificateManager.ShouldNotBeNull();
+            config.SecurityConfiguration.AutoAcceptUntrustedCertificates.ShouldBeFalse();
+            if (mode != SecurityMode.None)
+                Directory.EnumerateFiles(Path.Combine(root, "own"), "*", SearchOption.AllDirectories).ShouldNotBeEmpty();
+        }
+        finally
+        {
+            (config?.CertificateManager as IDisposable)?.Dispose();
+            if (Directory.Exists(root)) Directory.Delete(root, recursive: true);
+        }
+    }
+}