Discussed in UA meeting on May 03, 2022.

This has not changed since Version 1.02. People on the call think that the meaning is the manual configuration of an endpoint (including URL, certificate, user token, security mode, ...).
Of course this configuration can be wrong in which case the connect request will fail. But this can also happen after GetEndpoints in particular if the endpoint desciption is saved and re-used multiple times.

The discussion turned out into the question whether clients - if connect fails - should automatically try to find a proper alternative, replace the stored endpoint, and try to connect with that alternative.
We should at least prevent an automatic use of a lass secure alternative.

Possible conclusion: "When using a persisted endpoint - whether it was entered manually or received from GetEndpoints - this persisted information shall not be renewed without user intervention even if the connect fails."
This may also be a separate CU.

Suggest breaking this into 2 CUs:

One for manual configuration of endpoint URLs. (still need to call GetEndpoints).

One for use Client persisted endpoints to connect to a Server without using any Services in the Discovery Service Set. (make mandatory in 1.05, optional in 1.04).

It makes no sense to disable GetEndpoints. This requirement must be removed from Part 4.

In the automatic certificate update szenario with GDS, the client MUST call GetEndpoints to get the new certificate from the server. There is a special status code that indicates that the client is using the wrong certificate and GetEndpoints is the only way to get the new certificate. This new certificate will be used by the client if it is trusted (which will be the case for a GDS managed trust list).

If Clients are configured to use a certain endpoint setting, they should not change the used parameters by calling GetEndpoints but a updated certificate must be fetched with GetEndpoints.

If a Client has a "use best security" option, the client MUST verify the GetEndpoints results with the endpoints returned from CreateSession. It is much more important that clients do this check and this must be tested.

See also related Mantis Issue for Part 4