Needs CMP Group discussion:
Server returns an error message (ERR) not a ServiceFault. Needs group discussion whether the error response for a CreateSession requires to be a ServiceFault because the Request is an OPCUA Service or an error message which is for socket level (SecureChannel) issues.

Discussed in CMP Group:
In general returning an Error Message for a valid SeviceRequest is not allowed, a ServiceFault is required to be returned.

The other part regarding the RequestHandle needs a discussion with the UA Working Group whether providing the requestHandle in a ServiceFault is mandatory or just a should.

The ServiceRequest is not valid, because the Server is configured to support only secure channel,
the non-secure channel on such a server is only allowed to process:
GetEndpoints, FindServers, and in case of an LDS FindServersOnNetwork

Other requests wont reach the higher network layers, and cause the OpcUa_BadServiceUnsupported error response.
That is done to prevent possible security issues, as this server is not supposed handle any services beyond
those mentioned above in a non-secure channel.

During the UA Working Group call we identified that both options apparently are being used in released products. Some are returning an Error Message while others return a ServiceFault. Because of this, we decided that both options should be legal.
Mantis on Part 6 will be created to add Bad_ServiceUnsupported to Table 70, where the allowed StatusCodes are listed. Specification will also recommend to return an error message so applications are not necessarily waiting for all message chunks to be received but close the connection right away.

Adding a section in the UaResponseHeader.IsValid function to verify if an error message has been returned. If this is the case, any further check needs to be skipped as other fields are not provided in this message.

Also adding an option to print an error if a ServiceResponse is provided instead of an ErrorMessage. This may be required in future scenarios.

Review changes in call, agreed to updates , closed issue

Since it is now decided that both ErrorMessage as ServiceFault are possible, I would expect that CTT does not report an error.

CTT however reports
CreateSession.Response.Result: Good (0x00000000); but Expected: BadSecurityPolicyRejected (0x80550000) was expected.

see attached Wireshark for complete communication