Compliance Group Meeting: We are not sure on the problem. Can you join a future call to discuss and show what your are seeing? We do agree on the fact that the CreateSession can be skipped for that test case but we'd like to figure out why this happens to ensure that this doesn't indicate a deeper problem.

The problem still persists with the current CTT version,
if the server and CTT is configured to disable certificate time validation.

Interesting is that 007.js (expired certificate) succeeds.

I think the secure channel is created using the "not-yet-valid" certificate,
but the CreateSession Request sends a wrong certificate (not exired), and
the ActivateSession Request sends the signature which is probably signed
by the not-yet-valid cert, therefore the Server fails to validate the signature.

I think the difference is that 007.js has "SkipCreateSession: true"
while 008.js does not.
And indeed the wireshark captures of 007.js only show
OpenSecureChannelRequest/Response
CloseSecureChannelRequest.

while 008.js does:
OpenSecureChannelRequest/Response
CreateSessionRequest/Response
ActivateSessionRequest/Fault

Agree to add skip session, but will also check as to why the create session causes the failure.

Fixed as decided

Reviewed in CMP Call