feat(opcuaclient): opt-in server-certificate host-name check; NAT fixture keeps its PKI (#816, #818)

#816 finding: the SDK checks that the server certificate names the host only
when a session is created with checkDomain:true. The driver, the AdminUI
browser and Client.Shared all called the 8-argument
DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no
host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine
over an IP in #813). When enabled the SDK (Session.OpenAsync ->
ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost
— the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector
rewrote the advertised one — against the cert's DNS/IP SANs; secured
sessions only, and the auto-accept handler accepts a mismatch.

Policy: certificateValidation.validateServerHostName, tri-state. Unset =
OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the
pre-#816 behaviour, so nothing changes on upgrade; true = validate the
configured host; false = explicit NAT/port-publish opt-out. Threaded into the
driver, the AdminUI browser (same JSON) and the AdminUI form (a select that
keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName
and the CLI --validate-host-name. A driver refusal names the opt-out.

#818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified:
same thumbprint across --force-recreate), its PUBLIC cert is committed as
Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run
every secure browse on a throwaway PKI (internal browser seam): refusal with
nothing trusted, positive with the cert trusted (unset/false host check), and
a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is
OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch);
OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT
container's public cert. ServerHostNameValidationTests pin the driver against
the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in
v2-integration (440 -> 446), documented in scripts/ci/README.md.

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/CommandBase.cs

@@ -57,6 +57,13 @@ public abstract class CommandBase : ICommand
     [CommandOption("failover-urls", 'F', Description = "Comma-separated failover endpoint URLs for redundancy")]
     public string? FailoverUrls { get; init; }
 
+    /// <summary>
+    /// Gets a value indicating whether the server certificate must name the host given in <see cref="Url" /> (#816).
+    /// </summary>
+    [CommandOption("validate-host-name",
+        Description = "Require the server certificate to list the --url host (secured connections only; off by default — leave off behind NAT)")]
+    public bool ValidateHostName { get; init; }
+
     /// <summary>
     /// Gets a value indicating whether verbose Serilog output should be enabled for troubleshooting.
     /// </summary>
@@ -88,7 +95,8 @@ public abstract class CommandBase : ICommand
             Username = Username,
             Password = Password,
             SecurityMode = securityMode,
-            AutoAcceptCertificates = true
+            AutoAcceptCertificates = true,
+            ValidateServerHostName = ValidateHostName
         };
 
         return settings;

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultSessionFactory.cs

@@ -18,6 +18,7 @@ internal sealed class DefaultSessionFactory : ISessionFactory
         string sessionName,
         uint sessionTimeoutMs,
         UserIdentity identity,
+        bool validateServerHostName,
         CancellationToken ct)
     {
         var endpointConfig = EndpointConfiguration.Create(config);
@@ -26,7 +27,10 @@ internal sealed class DefaultSessionFactory : ISessionFactory
         var created = await new Opc.Ua.Client.DefaultSessionFactory(ClientTelemetry.Context).CreateAsync(
             config,
             configuredEndpoint,
-            false,
+            false,                       // updateBeforeConnect
+            // #816: the overload without checkDomain hard-codes false. The endpoint URL here is the operator's host
+            // (EndpointSelector rewrote the advertised one), so that is the host the certificate is checked against.
+            validateServerHostName,      // checkDomain
             sessionName,
             sessionTimeoutMs,
             identity,

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/ISessionFactory.cs

@@ -15,6 +15,9 @@ internal interface ISessionFactory
     /// <param name="sessionName">The session name.</param>
     /// <param name="sessionTimeoutMs">Session timeout in milliseconds.</param>
     /// <param name="identity">The user identity.</param>
+    /// <param name="validateServerHostName">
+    ///     The SDK's <c>checkDomain</c>: require the server certificate to name the endpoint URL's host (#816).
+    /// </param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A session adapter wrapping the created session.</returns>
     Task<ISessionAdapter> CreateSessionAsync(
@@ -23,5 +26,6 @@ internal interface ISessionFactory
         string sessionName,
         uint sessionTimeoutMs,
         UserIdentity identity,
+        bool validateServerHostName,
         CancellationToken ct = default);
 }

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Models/ConnectionSettings.cs

@@ -40,6 +40,15 @@ public sealed class ConnectionSettings
     /// </summary>
     public bool AutoAcceptCertificates { get; set; } = true;
 
+    /// <summary>
+    ///     Gitea #816 — require the server certificate to list the host of the URL being connected (the operator's
+    ///     host: discovery keeps it in place of the server-advertised one) among its subject-alternative names;
+    ///     a mismatch fails the connect with <c>BadCertificateHostNameInvalid</c>. Defaults to <c>false</c>, the
+    ///     behaviour before #816 (the SDK overload used never checked). Secured connections only. Leave it off behind
+    ///     NAT / a port publish / when connecting by an IP the certificate does not name.
+    /// </summary>
+    public bool ValidateServerHostName { get; set; }
+
     /// <summary>
     ///     Path to the certificate store. Defaults to <see cref="string.Empty"/>; the
     ///     consuming application configuration factory resolves the canonical path via

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/OpcUaClientService.cs

@@ -777,6 +777,7 @@ public sealed class OpcUaClientService : IOpcUaClientService
             SecurityMode = settings.SecurityMode,
             SessionTimeoutSeconds = settings.SessionTimeoutSeconds,
             AutoAcceptCertificates = settings.AutoAcceptCertificates,
+            ValidateServerHostName = settings.ValidateServerHostName,
             CertificateStorePath = settings.CertificateStorePath,
             Username = settings.Username,
             Password = settings.Password
@@ -794,7 +795,7 @@ public sealed class OpcUaClientService : IOpcUaClientService
 
             var sessionTimeoutMs = (uint)(settings.SessionTimeoutSeconds * 1000);
             return await _sessionFactory.CreateSessionAsync(config, endpoint, "OtOpcUaClient", sessionTimeoutMs, identity,
-                ct);
+                settings.ValidateServerHostName, ct);
         }
         catch
         {