The OPC UA Connection Protocol Error Message defined in Part 6 has two fields, Error and Reason. While the Error is a StatusCode the Reason is defined with "A more verbose description of the error". To meet this expectation there are products/SDKs which provide the exact reason for such an Error Message, even in case of a failed Certificate Validation. In the certification validation steps there are requirements to mask the Error with BadSecurityChecksFailed in many cases to prevent providing to much information to an attacker. But the specification is silent about the Reason in the Error Message, why logically it is still expected to provide a more verbose description.
To reduce the amount of information an attacker is getting, the specification should also indicate, to not provide more information by other mechanisms like this Reason field or the ServiceDiagnostics.